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treasures 


Our  globe-trotting  gadget 
guy  reveals  his  hidden 
gems  of  2011  in  the  12th 
annual  Cool  Yule  Tools 
package.  Page  28  ► 
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GETTING  A  HANDLE 
ON  COMPLEXITY 


Commerzbank  in  Germany  has  created 
an  IT  Complexity  Model  that  is  helping 
it  measure  the  complexity  problem  and 
guide  decision  making.  Page  12  ► 
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CLEAR  CHOICE  TEST:  WAN  OPTIMIZATION 

Cisco  WAAS 
shows  pizzazz 

WAVE  appliances  deliver  excellent 
performance,  but  no  UDP  support 

BYKEITH  SCHULTZ  ~ 

THE  LATEST  release  of  Cisco’s  WAN  optimization  prod¬ 
uct  line  —  Wide  Area  Application  Services  (WAAS)  4.4  — 
proves  that  the  company  famous  for  routing  packets  can 
also  shape,  optimize  and  accelerate  them.  WAAS  provides 
TCP  optimization,  data  compression,  application-specific 
optimization  and  intelligent  caching,  all  controlled  from  a 
single  browser-based  management  console.  WAAS  comes 
in  a  variety  of  form  factors  and  deployment  methods  —  a 
data  center  appliance,  branch  office  box,  virtual  WAAS  for 
cloud-ready  installations,  and  a  mobile  client  for  Windows 

►  See  Cisco,  page  1 7 
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your  move  to  the  cloud,  virtualization, 
and  big  everything  with 
HP  Converged  Storage. 


Reduce  cost  and  speed  deployment  with  the 
power  of  server  and  storage  convergence. 


With  HP  storage,  you  can: 

•  Get  your  storage  up  and  running  up  to  40%  faster 

•  Reduce  administration  time  by  up  to  90%‘ 


Whether  you're  deploying  a  cloud,  virtualizing  your  data 
center,  modernizing  your  applications,  or  preparing  to 
deal  more  efficiently  with  data  archiving,  be  prepared 
for  what's  next  with  HP  Converged  Storage— storage 
without  boundaries. 


See  how  HP  storage  can  eliminate  boundaries  between 
storage  and  the  rest  of  IT.  Watch  the  video  now  at 

hp.com/storage/3CI 


Or,  scan  this  QR  code 
with  your  mobile  device 


HP  Converged  Storage  solutions  powered 
by  Intel'5  Xeonr-J  processors 


o 


*For  details  on  claim  substantiations, 
visit  hp,com/storage/3CI 
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FROM  THE  EDITOR  JOHN  DIX 

Corralling  complexity 

It  has  been  referred  to  as  Moore’s  Flaw:  The  IT  com¬ 
plexity  that  results  from  the  inexorable  innovation  driven 
by  Moore’s  Law. 

“Complexity  increases  cost  and  decreases  flexibility  —  often  in  unfore¬ 
seen  ways  —  and  also  tends  to  decrease  stability,”  says  Peter  Leukert,  CIO 
of  Commerzbank,  one  of  the  largest  banks  in  Germany.  “If  you  run  IT, 

|  those  are  three  of  your  most  important  KPIs.” 

But  you  can’t  manage  what  you  can’t 
measure,  so  Leukert  set  out  to  get  a  better  handle  on  the 
problem.  The  result,  a  complexity  model  that  generates  a 
metric  that  can  be  used  to  gauge  complexity  and  aid  deci- 
sion  making  (see  page  12  for  a  Q&A  with  Leukert,  and 
tinyurl.com/6vzksj6  online  for  a  full  transcript). 

Initially  focused  on  application  complexity  in  the 
financial  sector,  the  goal  is  to  broaden  the  tool  for  usage 
in  other  industries,  says  Mat  Small,  partner  with  Capco, 
a  consultancy  in  New  York  that  has  teamed  with  Commerzbank  to  help  get  other 
institutions  involved  in  using  the  model.  Ultimately  the  tool  “will  evolve  into  a 
myriad  of  models”  that  address  the  “entire  IT  footprint,  even  an  IT  supply  chain,” 
Small  says. 

In  use,  Leukert  and  Small  anticipate  companies  tracking  IT  complexity  quar¬ 
terly  (more  frequently  over  time),  and  using  the  tool  to  provide  critical  insight  for 
major  IT  decisions. 

Regarding  the  latter,  Leukert  says  the  model  “helps  you  figure  out  where  you  can 
get  the  biggest  bang  for  the  buck.  It  can  give  you  an  indicator  that  says,  ‘Look,  if  you 
do  it  this  way,  it  might  be  better  in  the  short  term,  you  might  have  a  slightly  faster 
time  to  market  or  a  slightly  lower  administration  cost,  but  beware,  the  long-term 
impact  in  terms  of  complexity  is  huge,  and  that  will  in  the  end  translate  into  more 
long-term  cost  and  reduced  flexibility.’” 

Commerzbank  has  already  seen  some  eye-opening  results,  one,  a  counterintui¬ 
tive  indicator  about  the  need  for  master  data  management  tools. 

Is  the  model  one  of  those  grand  things  that  requires  a  mountain  of  input  and 
constant  care  and  feeding  which  virtually  guarantees  it  ends  up  as  shelfware?  No, 
according  to  Small.  “There  are  no  more  than  two  dozen  inputs  for  each  compo¬ 
nent,”  he  says.  “That’s  one  of  the  things  we’ve  invested  quite  a  bit  of  time  on.” 

Leukert  says  the  model  “helps  you  make  better-informed  decisions,  and  it  basi¬ 
cally  quantifies  something  that,  in  the  past,  all  the  architects  have  felt  and  talked 
about  qualitatively.” 

The  goal  now  is  to  get  more  companies  involved.  Let’s  hope  some  other  financial 
institutions  step  up  and  the  complexity  model  matures  to  the  point  where  it  is 
ready  for  a  broader  audience. 
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How  far  will  IT  certs  take  you? 

©  A  CERT  MAY  not  always  get  you  more 
money  but  it  will  help  get  you  a  job,  if 
for  no  other  reason  than  head  hunters 
and  HR  people  will 
never  see  your  resume 
because  they  are  only 
searching  for  buzz 
words.  Certs  are  a  little 
bit  of  a  barometer  of 
what  you  should  know, 
if  not  exactly  what  you 
do  know  (Re:  “Will  IT 
certs  get  you  j  obs  and 
raises?  Survey  says 
yes”;  page  10). 

The  most  important 
thing  to  remember  in 
a  market  such  as  this: 

There  is  a  lot  of  compe¬ 
tition  out  there.  So  a  cert  may  be  that  last 
thing  to  give  you  an  edge  over  another 
candidate.  Even  if  it  is  an  old  expired  cert. 

I  am  saying  all  this  from  experience. 

Damon  C.  Aniton 

©  IT’S  A  DIFFERENT  hiring  arena  out 
there  today  and  a  cert  just  isn’t  enough, 
especially  the  lower-level  certs.  Mostly  a 
cert  is  a  differentiator  in  the  job  market¬ 
place.  In  a  job  market  where  demand 
exceeds  supply,  certs  will  help.  But  not  in 
today’s  market.  Pick  and  choose  the  cert 
you  want  for  the  job  you  want  —  and  try  to 
get  closer  to  the  position  in  building  expe¬ 
rience.  Jobs  without  experience  today  are 
very  hard  to  come  by,  even  with  a  cert. 

Get  involved  in  your  local  ISSA  or  other 
related  trade  group  for  the  profession 
you  want  to  enter.  This  is  the  best  way  to 
engage  in  a  new  field.  Get  on  the  board 
if  you  can,  or  volunteer  for  supporting 
chapter  events  —  especially  if  you  are 
unemployed. 

debbiechristofferson 

The  future  of  Flash 

©  SINCE  "MOBILE  DEVICES”  includes 
most  tablet  computing  platforms,  what 
developers  in  their  right  mind  will  stick 
with  Flash  when  they’d  thus  be  shutting 
themselves  out  of  the  fastest-growing 
market  segment?  Adobe  optimism 
regarding  the  future  of  Flash  is  either 
disingenuous  or  misguided  (Re:  “Adobe’s 
decision  to  ditch  mobile  Flash:  What  you 
need  to  know”;  tinyurl.com/6o4o2u6). 

Joe  Whited 


©  KUDOS  TO  CHARLIE  for  chasingdown 
these  security  risks.  However,  I  would  love 
to  know  why  he  went  about  demonstrat¬ 
ing  the  vulnerability 
in  this  fashion  rather 
than  discussing  it 
with  Apple.  Was  he 
testing  the  application 
approval  process?  Was 
he  somehow  forced  to 
go  this  route  because 
his  concerns  fell  on  deaf 
ears,  or  was  it  mere 
grandstanding  (Re: 
'Apple  bans  researcher 
for  app  exposing  iOS 
security  flaw”;  tinyurl. 
com/828g451)? 
Demonstrating  the 
bug  that  allows  unapproved  code  to  be 
grabbed  from  a  server  and  executed  could 
have  been  done  without  the  app  in  the 
App  Store.  On  the  other  hand,  if  things 
were  done  safely,  how  many  of  us  would 
now  be  aware  of  this  vulnerability?  The 
other  thing  that  would  be  nice  to  know  is 
whether  this  is  a  flaw  only  with  iOS  4.3. 

drinksoymilk 

IBM  and  developer  productivity 

©  I  THINK  THE  guys  at  IBM  did  a  nice 
job  creating  a  system  to  drive  some 
athleticism  and  global  team  spirit  in  their 
internal  developer  community.  If  you  have 
measures  that  developers  understand  and 
believe  in,  putting  together  a  reputation 
score  is  fun,  and  who  knows,  it  might  lead 
to  some  learning.  It’s  a  bit  like  the  gaming 
movement  that’s  happening  now  in  the 
Agile  space.  Kudos  to  IBM  for  staying  on 
the  leading  edge  (Re:  “How  IBM  started 
grading  its  developers’  productivity”; 
tinyurl.com/7h7  gtxk). 

LevLesokhin 

©  THE  DARK  SIDE  of  metrics  is  that 
people  will  alter  their  behavior  to  get 
better  metrics,  even  if  what  they  do  is  less 
productive  or  lower  quality  than  what 
they  otherwise  did.  I’ve  seen  cases  where 
programmers  would  spend  half  an  hour 
calling  a  support  line  when  they  could 
have  run  a  five-minute  process  to  find  out 
the  information.  The  reason?  A  phone 
call  was  “free,”  but  every  process  they  ran 
counted  as  overhead  on  their  metrics. 

Tim  Holloway 
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Charter  Business®  Fiber  Solution  that  offered 
a  smart  alternative  to  critical  connection  uptime. 


When  swelling  bandwidth  demands  caused  bottlenecks  and  interruptions,  the 
director  of  Technology  Services  at  Eagle  Mountain-Saginaw  School  District  turned 
to  Charter  Business  Fiber  Solutions  for  a  faster,  scalable  connection. 


With  a  wholly  owned,  proactively  monitored  network  backed  by  an  enterprise 
support  team  24/7,  we  have  the  intelligence  to  help  schools,  healthcare  facilities, 
financial  institutions  and  businesses  of  every  size  run  at  their  best. 


I  Fiber  Internet 
Data  Networking 
Optical  Ethernet 
Advanced  Voice  Solutions 


Learn  more  about  this  story. 


0  Charter 

Business  Charter-Business.com/Technology  |  888.891.1598 


©  20H  Charter  Communications.  Services  may  not  be  available  in  all  areas.  Restrictions  apply.  Call  for  details. 
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iPhone  tops 
BlackBerry 
in  workplace 

APPLE’S  IPHONE  HAS  overtaken 
RIM’s  BlackBerry  devices  as  the  top 
smartphone  in  the  workplace,  accord¬ 
ing  to  a  new  study  from  enterprise 
mobility  services  company  iPass.  In  its 
survey  of  2,300  workers,  iPass  found 
that  45%  have  iPhones,  32.2%  have  BlackBerry  devices,  and 
21%  are  using  Android-based  devices.  In  addition,  18%  plan  to 
acquire  an  iPhone  in  2012  while  only  2%  plan  to  buy  a  Black¬ 
Berry.  The  iPass  survey  is  the  second  study  in  recent  months 
showing  BlackBerry  losing  its  clout  as  the  dominant  device  for 
enterprises.  Enterprise  Management  Associates  last  month 
reported  that  30%  of  BlackBerry  users  in  companies  of  10,000 
employees  or  more  plan  to  switch  to  a  different  platform  over 
the  next  year,  tinyurl.com/86oxfbx 
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ISC  patches 
BIND  flaw  that 
crashed  servers 
worldwide 

THE  INTERNET  Systems 
Consortium  (ISC)  released  a 
patch  for  an  actively  exploited 
denial-of-service  vulnerabil¬ 
ity  in  the  widely  used  BIND 
DNS  server.  ISC  launched  an 
investigation  into  the  issue  last 
week  after  many  organizations 
around  the  world  reported 
that  their  BIND  9-based  DNS 
resolvers  crashed  unexpectedly. 
ISC  determined  that  the  crashes 
are  the  result  of  an  inconsistent 
record  being  cached  and  then 
served  to  clients.  It’s  not  yet 


clear  what  kind  of  network  event 
causes  the  BIND  resolvers  to 
cache  the  malformed  record  in 
the  first  place,  but  security  spe¬ 
cialists  suspect  it’s  a  deliberate 
attack.  The  ISC  patch  consists  of 
two  components,  one  prevent¬ 
ing  the  server  from  returning 
inconsistent  data  from  cache  and 
the  other  preventing  the  server 
from  crashing  when  it  receives 
malformed  answers.  However, 
this  is  just  a  bandage  and  doesn’t 
fix  the  actual  vulnerability,  notes 
Carsten  Eiram,  chief  security 
specialist  at  vulnerability 
research  company  Secunia.  “We 
are  also  currently  analyzing  the 
vulnerability  in  order  to  deter¬ 
mine  the  core  problem.”  tinyurl. 
com/7sqnbs  5 


Facebook  porn 
attack  blamed 
on  naive  users 

FACEBOOK  HAS  blamed  a 
browser  vulnerability  and  naive 
user  behavior  for  the  explicit 
spam  campaign  that  hit  the 
service  last  week,  confronting 
tens  of  thousands  of  users  with 
a  fake  pornographic  image 
of  singer  Justin  Bieber,  and 
another  of  a  dead  dog.  Facebook 
says  it  has  tracked  down  the  root 
cause  as  being  a  “self-XSS”  flaw 
in  which  users  were  socially 
engineered  into  cutting  and 
pasting  malicious  JavaScript 
into  the  URL  bar,  executing  the 
attack.  Adding  the  moniker 
“self”  to  XSS  (cross-site  script¬ 
ing)  hints  that  the  company 
sees  the  issue  as  being  to  some 
extent  self-inflicted  by  unwary 
users.  “We’ve  built  enforce¬ 
ment  mechanisms  to  quickly 
shut  down  the  malicious  pages 
and  accounts  that  attempt  to 
exploit  it,”  Facebook  said.  The 
company  is  also  “putting  those 
affected  through  educational 
checkpoints  so  they  know  how 
to  protect  themselves.”  tinyurl. 
com/7cme38u 

Microsoft: 

We  won't 
update  others' 
Windows  apps 

MICROSOFT  LAST  week 
slammed  the  door  on  updating 
third-party  software  via  Win¬ 
dows  Update  in  the  upcoming 
Windows  8.  The  new  operat¬ 
ing  system  will  not  update 
non-Microsoft  software,  said 
Farzana  Rahman,  the  group 
program  manager  for  Windows 
Update,  in  a  blog  post:  “The 
wide  variety  of  delivery  mecha¬ 
nisms,  installation  tools,  and 
overall  approaches  to  updates 
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l  Researchers 
find  new 
way  to  hide 
messages 
in  VoIP 


RESEARCHERS  HAVE 

devised  a  new  scheme 
for  hiding  secret  data 
within  Vol  lJ  packets, 
making  it  possible  to 
carry  on  legitimate 
voice  conversations 
while  stolen  data 
piggybacks  < >n  the  call 
undetected,  making 
its  way  to  thieves  on 
the  outside.  Called 
transcoding  steganog- 
raphy,  or  TranStcg,  the 
method  calls  for  setting 
a  larger- 1  ban- necessary 
payload  space  in  VoIP 
packets  and  using  the 
extra  room  to  carry 
covert  messages.  In 
their  experiment, 
researchers  at  the 
Warsaw  Institute  of 
Technology  could  send 
2.2MB  of  covert  data  in 
each  direction  during 
an  average  seven - 
minutephonecall 
One  big  hurdle  to  the 
practical  use  of  Tran¬ 
Stcg,  however,  is  that  it 
requires  modifying  the 
machines  that  send  am  1 
receive  thestegano 
graphic  messages.  sa\ 
(lie researchers  led  lay 
Wojdech  Mazurczy, 
who  has  developed 
ot  I  icr  V<  >1 1  ’  st  eganogra 
phy  techniques,  tinyurl. 
com/84ce2l3 
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The  Power  of  We™ 


Nothing  speeds  the  pace  of  business  like  collaboration. 

This  is  why  Avaya  is  dedicated  to  delivering  products  that  allow  the  right  people 
to  share  the  right  information  in  real  time.  Because  faster  collaboration  leads  to 
smarter  decisions.  And  smarter  decisions  are  a  sure  path  to  a  better  business. 

Learn  how  real-time  collaboration  can  improve  your  business  at 
avaya.com/thepowerofwe. 


©2011  Avaya  Inc.  All  rights  reserved. 
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Obfuscated  C  Code 
back  in  vogue 


THE  CREATORS  behind 
the  long-running  Internet 
contest  to  write  bizarre 

and  unnecessarily  complex  C  programming  code, 
called  the  International  Obfuscated  C  Code  Contest 
(IOCCC),  have  resurrected  their  challenge  after  being 
on  hiatus  for  five  years.  "You  can  never  say  all  the 
tricks  have  been  done.  Someone  always  shows 
you  something  you  didn’t  know,"  said  Landon 
Curt  Noll,  one  of  the  founders  of  IOCCC.  "Every 
year  you  think  ‘Gee,  I  didn’t  think  you  could 
do  that.’"  The  goal  of  the  contest,  as  in  year’s 
past,  is  to  produce  a  batch  of  mind-bogglingly 
difficult-to-understand  code,  written  in  the  C  pro¬ 
gramming  language.  The  group  will  begin  accepting 
submissions  for  this  year’s  contest,  starting  Dec.  1. 
Deadline  for  submissions  is  Jan.  12,  2012. 


across  the  full  breadth  of  appli¬ 
cations  makes  it  impossible  to 
push  all  updates  through  [the 
Windows  Update]  mechanism. 
As  frustrating  as  this  might  be, 
it  is  also  an  important  part  of 
the  ecosystem  that  we  cannot 
just  revisit  for  the  installed 
base  of  software.”  Rahman’s 
statement  was  the  clearest  ever 
by  Microsoft  that  it  would  not 
take  other  applications  under 
its  update  wing.  One  security 
expert  said  the  company  was 
missing  a  big  opportunity  to 
improve  the  overall  security 
of  Windows  PCs.  “Microsoft 
could  collect  a  huge  amount  of 
goodwill  by  doing  this,  and  it 
would  be  a  huge  leap  for  secu¬ 
rity,”  said  Wolfgang  Kandek, 
CTO  for  Qualys.  tinyurl. 
com/6lscn6w 


Cox  bows  out  of  wireless 


I 


COX  COMMUNICATIONS,  which  planned  its  own 
mobile  network  in  2008  but  later  settled  for  reselling 
Sprint  Nextel  service,  last  week  stopped  selling  wire¬ 
less  altogether.  The  third-largest  U.S.  cable  opera¬ 
tor  said  it  was  leaving  the  business  because  it 
could  not  offer  the  network  scale,  4G  speed  or 
popular  devices  to  compete  with  established 
mobile  carriers.  Subscribers  will  be  able  to  con¬ 
tinue  using  the  service  through  March  and  keep 
their  mobile  devices,  with  all  early  termination  fees 
waived.  They  will  receive  a  $150  credit  on  their  bills 
for  each  wireless  line  that  is  disconnected. 


NASA  hacked 


ROMANIAN  AUTHORITIES  have  arrested  a  26-year 
old  hacker  who  is  accused  of  breaking  into  multiple 
NASA  servers  and  causing  $500,000  in  damages 
to  the  U.S.  space  agency’s  systems.  Robert  Butyka, 
26,  was  arrested  in  Western  Romania,  following  an 
investigation  by  the  Romanian  Directorate  for  Inves¬ 
tigating  Organized  Crime  and  Terrorism  (DIICOT). 

According  to  local  reports,  the  hacker  used  the 
online  moniker  of  "Iceman."  Authorities  claim 
that  the  hacker  destroyed  protected  data  and 
restricted  access  to  it. 


HP  unveils  its 
first  business 
ultrabook 

HP  INTRODUCED  its  first 
business  ultrabook,  offering 
nine  hours  of  battery  life,  a 
solid-state  drive,  and  a  security 
chip  that  protects  data  in  email 
and  information  on  the  hard 
drive.  The  rollout  by  HP  comes 
less  than  a  month  after  the 
company  said  that  its  Personal 
Systems  Group,  which  deals  in 
PCs,  smartphones  and  tablets, 
will  stay  with  the  company.  The 
new  ultrabook,  called  the  HP 
Folio,  will  go  on  sale  Dec.  7  at  a 
starting  price  of  $900.  It  has  a 
13.3-inch  diagonal  high-defini- 
tion  display,  weighs  3.3  pounds 
and  is  0.7  inches  thick,  tinyurl. 
com/72ubvb4 


IT  VIDEO 

Tech  company 
helps  vets 
digitize  old 
photos 

A  San  Francisco  Tech 
company  helps  preserve 
World  War  II  memories 
by  visiting  veterans  and 
recording  oral  histories 
as  well  as  scanning 
their  photos. 
tinyurl.com/cgxxvy4 


Amazon  adds 
supercomputing 
service  to 
its  cloud 

AMAZON  WEB  Services (AWS) 
wants  to  attract  more  high- 
performance  computing  users 
to  its  cloud  and  has  launched  a 
public  beta  of  Cluster  Compute 
Eight  Extra  Large,  its  most 
powerful  cloud  service  yet. 
Every  Cluster  Compute  Eight 
r  Extra  Large  instance  has  two 
Intel  Xeon  processors,  each 
with  eight  hardware  cores,  and 
comes  with  60.5GB  of  RAM  and 
3.37TB  of  storage.  The  service  is 
priced  at  $2.40  per  hour  for  an 
on-demand  instance,  and  users 
can  choose  between  Linux  or 
Windows  Server  2008  R2  as 
their  operating  system.  Applica¬ 
tions  that  are  a  good  fit  include 
physics  simulations,  seismic 
analysis,  drug  design,  genome 
analysis,  aircraft  design,  and 
a  variety  of  business  comput¬ 
ing  and  analytics  applica¬ 
tions,  Amazon  said,  tinyurl. 
com/7gxo2gv 
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IBM  BladeCenter®  S 
and  HS22  Express 

with  storage  and  networking  from 


$£OQ0G  Per  month 
D^y,  for  60  months1 
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Say  hello  to  your  entire  server  room. 

Imagine  if  you  could  consolidate  servers,  storage  and  networking  I/O  into  one  simple  package.  Just  think 
what  would  happen  to  your  IT  operating  costs.  That’s  exactly  what  many  midsize  businesses  are  doing. 
They’re  converging  their  IT  infrastructure  on  IBM  BladeCenter  S  and  HS22  servers  featuring  Intel®  Xeon® 
processors.  Through  virtualization,  they’re  reducing  servers  by  up  to  85%  and  cutting  energy  and  facilities 
costs  by  up  to  96%,  all  while  actually  improving  performance.2  They’re  enjoying  superior  availability  with 
features  like  redundant  power  and  I/O.  And  they’re  deploying  the  integrated  SAN  capability  for  up  to  $4,900 
less  than  competitive  offerings.3 


Take  10  minutes  to  see  for  yourself. 

Learn  how  you  could  achieve  up  to  a  3-month  ROI  on  your  migration  with 
our  System  Consolidation  Evaluation  Tool  at  ibm.com/systems/consolidate. 
To  connect  with  the  right  IBM  Business  Partner,  call  877-IBM-ACCESS. 


60  month  FMV  lease  from  IBM  Global  Financing,  “best  credit”  business  customer.  Prices  are  current  as  of  5/20/11;  subject  to  change  without  notice; 
based  on  manufacturer's  suggested  retail  price;  dealer  prices  may  vary.  Financing  provided  through  IBM  Credit  LLC  in  the  United  States  and  other  IBM 
subsidiaries  and  divisions  worldwide  to  qualified  commercial  and  government  customers.  Minimum  transaction  size:  $5,000:  rates  based  on 
creditworthiness,  terms,  offering  and  equipment  type  and  options,  and  may  vary  by  country.  Other  restrictions  may  apply.  Rates  and  offerings  are  subject 
to  change,  extension  or  withdrawal  without  notice.  Please  contact  your  IBM  Authorized  Business  Partner  or  IBM  representative  lor  more  information, 
’Sources  for  the  claims  can  be  found  at  www.ibm.com/systems/consolidate.  ‘$4,900  cost  savings  vs.  Hewlett-Packard  blade  enclosure  and  servers  was 
calculated  using  public  sources  as  of  May  2011.  Items  compared  were  IBM  BladeCenter  S  chassis  with  SAN  and  six  IBM  HS22  servers  vs.  Hewlett- 
Packard’s  c3000  blade  enclosure  with  SAN  and  six  Bl.  460  G7  servers.  IBM,  the  IBM  logo,  ibm.com  and  BladeCenter  are  trademarks  of  International 
Business  Machines  Corp,  registered  in  many  jurisdictions  worldwide.  A  current  list  of  IBM  trademarks  is  available  on  the  Web  at  www.ibm.com/legal/ 
copytrade.shtml.  Intel,  the  Intel  logo,  Xeon  and  Xeon  Inside  are  trademarks  or  registered  trademarks  of  Intel  Corporation  in  the  United  States  and  other 
countries.  All  other  products  may  be  trademarks  or  registered  trademarks  ot  their  respective  companies.  ©  International  Business  Machines  Corporation 
2011.  All  rights  reserved. 
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TREND  ANALYSIS 


Survey  says  IT  certs  get  you  jobs  and  raises 


What  was  your  your  greatest  motivation  for 
pursuing  certification(s)? 


■  To  position  myself  for  a 
promotion/other  jobs 

■  Simply  wanted  to  learn 
about  this  technology 

An  increase  in  salary 

H  It  was  required  for  my  job 

Other  (please  specify) 

Based  on  survey  of  700  network  professionals 


BY  JULIE  BORT 

DEBATE  RAGES  among  IT  professionals 
over  the  value  of  certifications,  but  a  survey  of 
700  network  professionals  jointly  conducted 
by  Network  World  and  SolarWinds  may  help 
put  that  argument  to  rest.  Among  those  who 
earned  certifications,  most  saw  a  significant 
boost  in  their  careers  as  a  result. 

Some  60%  said  a  certification  led  to  a  new 
job;  50%  said  they  earned  more  pay,  with  40% 
saying  their  pay  increased  by  more  than  10% 
directly  because  of  a  certification;  and  29% 
said  a  cert  led  to  a  promotion. 

Respondents  also  offered  advice  on  when 
to  get  certifications  and  which  ones  to  get. 
Interestingly,  they  named  Cisco  certifications 
as  both  the  most,  and  the  least,  valuable. 

“I  have  certifications,  and  yes  they’ve  been 
a  big  help  to  me,”  says  Jeff  Schoonmaker,  a 
junior  network  administrator  in  Portland, 
Ore.,  who  has  a  Cisco  CCNA,  a  Microsoft 
MCITP  (Enterprise  Desktop  Administra¬ 
tor)  and  the  CompTIA  A+.  Schoonmaker  has 
been  an  IT  professional  for  a  little  over  a  year 
and  says  his  CCNA  helped  land  him  his  job 
and  the  MCITP  has  already  led  to  a  promo¬ 
tion.  He’s  working  on  his  CCNP,  and  when  he 
achieves  that,  he’ll  get  another  promotion. 

“As  far  as  my  career  is  concerned,  certifica¬ 
tions  are  huge.  I  will  continue  to  chase  certs 
from  Microsoft  and  Cisco  throughout  my 
career,”  he  says. 

Half  of  respondents  said  they  pursued 
certifications  to  get  a  promotion  or  to  be  eli¬ 
gible  for  a  new  job.  “My  company  wanted  a 
Microsoft-certified  IT  manager,  so  the  MCSA 
helped  me  get  the  job  I  am  currently  in,”  said 
one  respondent.  “I  was  able  to  stay  working 
for  a  defense  contractor  when  one  contract 
expired  by  moving  to  a  different  contract  due 
to  the  certifications  I  held,”  another  said. 

Since  three-quarters  of  respondents  had 
certifications,  that  means  one-quarter  (26%) 
saw  no  value  in  them.  “I  have  no  certs  to  my 
name  at  all.  I  do  have  an  MBA.  I  have  been  in 
IT  hardware  and  network  admin/engineer 
roles  for  over  a  decade  now  without  a  single 
piece  of  paper  related  to  the  field.  You  learn 
as  you  go,  better  than  you  learn  in  some  stu¬ 
pid  classroom,”  commented  James7360  on  a 
Spiceworks  forum. 

But  James7360  is  in  the  minority.  Even  net¬ 
work  professionals  earning  the  highest  wages 
—  more  than  $110,000  —  had  as  many,  or 
more,  certs  as  those  in  lower  salary  brackets. 

That’s  not  to  say  that  the  certs  themselves 
are  solely  responsible  for  these  high  salaries. 


Those  earning  the  most  money  also  had  more 
years  of  experience  (75%  had  more  than  10 
years)  and  more  traditional  education  (25% 
had  a  master’s  degree,  compared  to  11%  in  the 
lower  salary  brackets). 

But  even  so,  among  the  highest-paid  IT 
professionals  who  had  certs,  58%  said  a  cert 
led  to  a  salary  boost  or  bonus,  63%  said  it  led 
to  a  promotion  and  30%  to  a  new  job.  These 
numbers  are  similar  to  those  in  the  lower  sal¬ 
ary  brackets,  who  also  overwhelmingly  said 
that  certs  led  to  a  salary  boost  or  bonus  (55%), 
new  job  (62%)  or  promotion  (27%). 

Those  earning  the  highest  wages,  $110,000 
or  more  a  year,  were  also  more  likely  to  have 
particularly  difficult  (and  expensive)  certifi¬ 
cations,  like  the  CCIE,  RHCE  or  CISSP. 

“I  have  had  a  certification  lead  to  a  new  job 
or  promotion,  the  CISSP,  which  isn’t  even  a 
technical  certification.  It  really  teaches  how 
to  control  and  translate  security  into  business 
objectives.  But  it  is  required  for  a  lot  of  secu¬ 
rity  jobs  and  has  requirements  like  ongoing 
education  in  order  to  maintain  it,”  says  Lee 
Eddy  II,  a  senior  security  analyst  in  Redwood 
City,  Calif.,  with  more  than  10  years  of  experi¬ 
ence  as  an  IT  professional.  The  CISSP  helped 
Eddy  land  a  job  with  a  big  salary  increase, 
and  is  mandated  for  most  of  the  higher-paid 
jobs  in  his  field,  he  says. 

The  value  of  a  certification  clearly  depends 
on  a  lot  of  factors.  Some  hiring  managers 
want  them  more  than  others,  and  timing  is 
an  issue,  too. 


“I’d  have  to  say  certs  tend  to  be  more  valu¬ 
able  when  they  are  coupled  with  the  building 
of  experience,”  says  Craig  Norborg,  a  network 
engineer  for  Trowbridge  &  Trowbridge, 
Albuquerque,  N.M.,  with  more  than  15  years 
of  experience  and  a  variety  of  certs,  including 
the  CCNP,  CCDA,  MCSE,  SCP  (SolarWinds 
Certified  Professional)  and  others. 

“If  you  get  them  too  early,  people  think 
they’re  book  certs.  If  you  get  them  too  late, 
you’re  just  proving  what  you  already  know, 
which  may  not  be  required,”  Norborg  points 
out.  “Employers  are  pretty  suspicious  of 
many  high-end  certs  from  a  young  person,  or 
someone  just  entering  the  field.” 

The  difficulty  of  the  certs  and  the  type  of 
technology  they  cover  can  also  add  value  —  or 
not.  “My  MCSE  hasn’t  really  done  anything 
for  me.  My  last  two  employers  actually  would 
rather  I  not  touch  servers,  but  instead  special¬ 
ize  in  networking,”  Norborg  says.  Note  that 
for  Windows  Server  8  and  beyond,  Microsoft 
has  discontinued  its  umbrella  MCSE  certifi¬ 
cation  in  favor  of  a  range  of  technology-spe¬ 
cific,  MCITP  certs. 

In  a  survey  of  network  professionals,  it’s 
not  surprising  that  certifications  on  net¬ 
work  technology  were  the  most  popular 
and  deemed  the  most  valuable.  Some  67%  of 
respondents  had  earned  one,  with  Cisco  certi¬ 
fications  far  and  away  the  most  popular.  Fully 
44%  of  those  making  more  than  $110,000 
had  the  ultra-hard  (and  expensive)  CCIE. 

►  See  Certification,  page  16 
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OpenFlow  not  the  only 
path  to  net  revolution 


BYJIM  DUFFY 

APIs  AND  messaging  protocols,  including  some  that  are  standards,  can  let 
users  build  software-defined  networks  today.  The  key  issue,  though,  is  that 
not  everyone  implements  the  same  ones  or  implements  them  the  same  way. 
Will  OpenFlow  get  us  all  on  the  same  path  to  SDN  nirvana? 

OpenFlow  is  an  open  source  API  defined  to  enable  multivendor  switches 
and  routers  to  be  programmable  through  software  on  a  central  control 
element.  It’s  designed  to  manage  and  direct  traffic  among  routers  and 
switches  from  various  vendors  by  separating  the  programming  of  routers 
and  switches  from  underlying  hardware  in  order  to  provide  consistency  in 
flow  management  and  engineering. 

OpenFlow  proponents  say  the  API  and  protocol,  and  SDNs  in  general,  will 
open  networks  to  more  innovation  by  providing  a  level  of  abstraction,  or  vir¬ 
tualization,  between  network  control  and  the  physical  infrastructure. 

“Most  of  the  applications  that  we’re  looking  at  that  are  really  useful 
around  SDN  (such  as  virtualized,  multitenant  data  centers)  are  things 
that  I  just  can’t  picture  building  without  OpenFlow,”  says  Kyle  Forster,  co¬ 
founder  of  Big  Switch  Networks,  a  maker  of  OpenFlow  controllers. 

“We  all  recognize  that  managing  networks  that  span  multiple  data 
centers,  that  may  or  may  not  be  owned  by  the  company,  is  becoming  too 
complex  regardless  of  all  the  other  advancements  being  made,”  says  Derek 
Silva,  an  analyst  at  Info-Tech  Research  Group.  “Network  management 
needs  to  be  easier,  and  I  feel  that  the  vision  developed  by  the  SDN  move¬ 
ment  and  [OpenFlow  evangelist  Open  Networking  Foundation]  is  prob¬ 
ably  the  best  way  to  make  it  happen.” 

But  there  are  other  considerations  at  play  as  well,  such  as  where  to  physi¬ 
cally  locate  the  flow  controllers,  and  these  considerations  are  leading  some 
to  look  beyond  OpenFlow. 

“The  OpenFlow  discussion  assumes  the  controller  is  on  a  separate 
device,”  says  Peter  Christy,  co-founder  of  the  Internet  Research  Group.  “A 
reasonable  SDN  configuration  is  to  distribute  the  controller  software  onto 
each  of  the  switches.  In  the  case  where  the  SDN  controller  is  distributed  to 
each  of  the  switches  it  wouldn’t  make  engineering  sense  to  literally  imple¬ 
ment  a  formal  communication  protocol  within  the  box.” 

Christy  says  an  SDN  that  distributes  the  controller  to  the  switches  would 
improve  the  performance  of  communication  between  switch  and  control¬ 
ler,  and  improve  the  operation  of  the  SDN.  He  says  Juniper’s  QFabric  archi¬ 
tecture  is  an  example  of  an  SDN  with  a  distributed  control  plane. 

Arista  Networks  says  its  switch  customers  can  implement  SDNs  using 
either  controllers  or  distributed  network  control.  The  company  says  there 
are  pros  and  cons  to  both  approaches,  but  that  both  are  required  to  imple¬ 
ment  a  comprehensive  SDN. 

Arista  defines  four  “pillars”  of  software-defined  cloud  networking:  cloud 
topology,  distributed  control,  network  virtualization  and  management/ 
automation.  OpenFlow  is  one  API  among  several  that  can  be  used  in  the 
management/automation  pillar  if  the  SDN  is  controller-based,  according 
to  Arista.  Others  are  existing  CLIs,  SNMP,  XMPP,  Netconf,  OpenStack,  and 
APIs  in  VMware’s  vSphere  virtualization  software,  Arista  says. 

There  are  use  cases  for  each,  says  Jayshree  Ullal,  Arista  CEO.  For  Open- 
Flow,  she  sees  the  use  case  as  dynamic  packet  redirection  for  network  tap 
aggregation,  lawful  intercept/CALEA,  and  topology-agnostic  network 
segmentation  deployments. 

Whether  that  translates  into  broad  adoption  remains  to  be  seen. 

“The  more  use  cases  it  can  be  deployed  in,  the  stronger  its  applicability 

►  See  OpenFlow, page  16 
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Getting  a  handle  on  complexity 


Peter,  tell  us  about  the  complexity  issues 
you  face  and  what  you’re  hoping  to  get 
out  of  the  model  you  developed. 
LEUKERT:  In  an  environment  like  ours  with 
more  than  a  thousand  business-relevant 
applications,  you  see  complexity  increasing, 
and  every  CIO  I  talk  to  shares  the  opinion  that 
complexity  is  an  issue.  But  it  is  very  hard  to 
get  under  control.  Why  is  it  hard?  Because  it 
keeps  creeping  up  on  you  and,  compared  to 
budget,  for  example,  you  can’t  localize  it.  To 
manage  budget,  if  I  get  100  and  I  have  five 
reports,  each  of  them  gets  20  and  I  deal  with 
everyone  who  goes  above  20,  so  you  can  local¬ 
ize  the  problem.  With  complexity,  that  doesn’t 
work  because  it’s  the  interaction  of  many, 
many  efforts  and  you  only  feel  the  effect  in 
the  aggregate.  Another  reason  it  is  hard  is  we 
cannot  measure  it.  And  that  was  really  the 
guiding  thought  behind  the  model. 

Complexity  increases  cost  and  decreases 
flexibility  —  often  in  unforeseen  ways  —  and 
also  tends  to  decrease  stability.  If  you  run 
IT,  those  are  three  of  your  most  important 
KPIs.  So  all  three  are  adversely  affected  by 
complexity.  We  started  building  the  model 
three  years  ago  and  collected  a  time  series  of 
data,  but  you  can  only  learn  so  much  from 
your  own  data.  What  I’m  really  interested 
in  is  benchmarking  myself  against  other 
institutions.  That’s  the  main  reason  for  us 
to  join  forces  with  Capco,  to  get  other  banks 
and  financial  institutions  involved. 

Mat,  the  first  whitepaper  about  the  com¬ 
plexity  model  that  Capco  co-authored 
with  Commerzbank  says  the  model  is 
designed  to  help  organizations  “model, 
measure  and  master”  complexity, 
but  go  a  little  deeper  for  us. 

SMALL:  It  is  a  model  based  on  inputs  that 


veryone  knows  complexity  is  a  foe  ofIT.  But  how  bad  is 

it,  and  how  do  you  tell  if  your  decisions  are  making  it  better  or 
worse?  Peter  Leukert,  CIO  of  Commerzbank,  one  of  the  larg¬ 
est  banks  in  Germany,  set  to  find  out.  Leukert,  who  runs  the 
financial  service  giant’s  3,800  member  centralized  IT  group, 
built  an  IT  Complexity  Model  to  get  a  handle  on  the  problem, 
and  then  turned  to  consulting  firm  Capco  Partners  to  help  get 
other  financial  service  firms  involved.  Network  World  Editor  in  Chief  John  Dix 
recently  caught  up  with  Leukert  and 
Mat  Small,  partner  with  Capco  in 
New  York,  for  a  briefing  on  the  effort. 


PETER  LEUKERT, 
COMMERZBANK 


MAT  SMALL, 
CAPCO PARTNERS 


generates  a  metric.  The  model  itself  has  been 
statistically  validated  by  Professor  Martin 
Mocker  at  MIT,  so  the  math  is  very  tested. 
And  Capco  and  Commerzbank  have  been 
refining  the  inputs,  refining  definitions  of 
inputs,  continually  validating  that  as  we  add 
or  amend  inputs.  Over  the  next  year  we’re 
going  to  take  data  that  defines  IT  in  other 
financial  service  organizations  and  start 
running  the  model  against  those  inputs, 
producing  metrics  that  are  appropriate  for 
those  firms.  And  then  over  time  we  will  have 
created  a  larger  set  of  benchmark  data  so  dif¬ 
ferent  organizations  would  be  able  to  start 
accessing  larger  problem  statements. 

You  are  only  looking  at 
application  complexity,  right? 

SMALL:  Yes,  just  the  application  stack.  So 
the  model  does  not  look  at  peripherals  or  the 
infrastructure. 


Peter,  many  organizations  are  trying  to 
deal  with  complexity  by  consolidating 
data  centers  and  servers,  and  reducing 
application  count,  so  I  presume  you  are 
undertaking  these  kind  of  efforts  as  well? 
LEUKERT:  Due  to  the  takeover  of  Dresdner 
Bank  by  Commerzbank,  we  were  in  the 
fortunate  but  unusual  situation  to  actually 
halve  our  complexity  by  shutting  down  most 
of  the  Dresdner  systems.  We  basically  closed 
down  half  of  the  total  application  inventory 
of  the  combined  bank.  And  of  course  we 


have  also  consolidated  the  network  and  the 
data  centers.  So  yes,  consolidating  applica¬ 
tions  clearly  reduces  complexity.  But  our 
model  helps  you  be  more  sophisticated 
about  it  because  it  helps  you  figure  out 
where  you  can  get  the  biggest  bang  for  the 
buck.  It  can  give  you  an  indicator  that  says, 
“Look,  if  you  do  it  this  way,  it  might  be  better 
in  the  short  term,  you  might  have  a  slightly 
faster  time  to  market  or  a  slightly  lower 
administration  cost,  but  beware,  the  long¬ 
term  impact  in  terms  of  complexity  is  huge, 
and  that  will  in  the  end  translate  into  more 
long-term  cost  and  reduced  flexibility.” 

Does  the  model  specify  enough  inputs  to 
make  critical  decisions,  or  will  you  need 
to  flesh  them  out  with  time? 

LEUKERT:  Keep  in  mind  that  there  will 
always  be  other  factors  to  consider.  It’s  not 
an  automatic  thing  where,  say,  “If  complex¬ 
ity  is  above  20  then  don’t  do  the  project.”  It’s 
more,  “If  the  complexity  increase  is  far  in 
excess  of  the  project  value,  think  again  about 
doing  the  project.”  Our  model  helps  you 
make  better-informed  decisions,  and  it  basi¬ 
cally  quantifies  something  that,  in  the  past, 
all  the  architects  have  felt  and  talked  about 
qualitatively.  As  you  know,  if  there  are  three 
quantitative  arguments  and  one  qualita¬ 
tive  one,  the  latter  always  becomes  weak  in 
comparison  to  the  quantitative  ones.  And 
that’s  why  if  you  can  make  that  quantitative, 
it  becomes  more  powerful. 

So  that’s  one  use  case.  And  the  other  is 
concerning  profound  decisions,  questions 
of  really  transforming  a  major  part  of  your 
architecture:  modernizing  a  legacy  system 
or  something  like  that.  The  model  can  help 
by  telling  you  it  is  worth  taking  the  risk  and 
making  the  investment  because  not  only  will 
you  reduce  operational  costs,  but  you  also 
will  substantially  reduce  complexity. 

Can  you  give  us  an  example  of  how  you 
have  used  the  model? 

LEUKERT:  Sure.  We  are  currently  using  the 
model  to  evaluate  master  data  management 
tools  within  the  bank.  We  have  at  least  seven 
different  systems  holding  customer  master 
data  and  we’re  evaluating  the  best  strategy 
to  consolidate  that.  In  one  scenario  you  say, 
“OK,  I’ll  do  a  greenfield  approach.  I  wish  to 
start  over  and  migrate  all  this  into  a  consistent 
data  model  in  one  new  system.”  Or  we  can 
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take  a  more  evolutionary  approach  and  say, 
“I’ll  build  upon  one  or  two  of  these  existing 
systems  and  extend  them  in  an  evolutionary 
fashion.”  Complexity  is  a  very  important 
guideline  in  making  this  decision  because  it 
really  gives  you  insights  into  how  different 
they  are,  the  effects  in  the  core  domain  of  cus¬ 
tomer  master  data  itself  and  also  the  effects 
on  the  overall  application  landscape  because 
of  all  the  apps  consuming  master  data. 

Have  you  come  to  a  conclusion? 
LEUKERT:Ithink  we  are  pretty  close  to 
concluding.  And  it  seems  at  the  moment 
that  the  evolutionary  approach  is  really  the 
superior  one. 

That’s  fascinating.  Do  you  think  you 
might  have  come  to  a  different  conclusion 
if  you  didn’t  have  the  complexity  tool? 
LEUKERT:  Yes.  Because  we  looked  at  the 
question  a  couple  of  years  ago  and  at  that 
point  we  actually  thought  the  only  way  to 
solve  the  problem  would  be  the  greenfield 
approach.  We  thought  the  other  way  would 
not  really  solve  the  problem,  and  by  having 
looked  at  the  complexity  levels,  we  see  this  is 
a  very  valid  alternative. 


How  do  you  anticipate  the  model  being 
used? 

SMALL:  I  think  it  will  have  relevance  for  any 
organization  that  faces  change.  They  would 
probably  start  by  looking  at  the  metric  quar¬ 
terly  —  did  complexity  increase  or  decrease 
from  the  quarter  before?  —  and  then,  over 
time,  advance  that  to  monthly.  I  doubt  over 
the  next  five  years  you’d  see  people  executing 
this  more  frequently. 

How  granular  do  the  inputs  get  in  terms 
of  describing  your  environment? 

SMALL:  Today  there  are  no  more  than  two 
dozen  inputs  for  each  component.  I  would 
expect  that  would  continue  to  increase  over 
time,  but  they’re  not  all  required  to  execute 
the  model. 

That  sounds  promising,  because  some¬ 
times  these  types  of  things  get  so  big  and 
complex  that,  over  time,  they  don’t  get 
used  because  too  much  work  is  involved. 

SMALL:  That’s  one  of  the  things  we’ve 
invested  quite  a  bit  of  time  on.  As  we  intro¬ 
duce  other  companies  to  the  model,  we’ll 
look  at  prioritizing  inputs.  We  might  end 
up  with  multiple  levels.  So,  there  may  be 
priority  one  inputs  that  must  be  captured. 


the  attributes  that  have  to  go  in  for  the  model 
to  run.  And  then  a  priority  two  set  that  pro¬ 
vides  for  greater  model  precision,  but  you’ve 
already  captured  the  directional  soundness 
of  the  model  just  by  running  the  must-haves. 
And  then  priority  threes,  which  in  fact  aren’t 
even  necessary  for  the  model  but  they’re  nice 
to  have  in  understanding  the  results  of  the 
model.  But  that’s  not  there  yet. 

Given  you  only  have  a  couple  dozen 
inputs  for  each  component,  how  can 
you  reach  such  meaningful  business 
conclusions? 

SMALL:  Don’t  forget  this  is  an  analytic; 
it’s  not  meant  to  replace  a  CIO  or  a  CIO’s 
experience.  It’s  simply  meant  to  challenge  or 
validate  that  experienced  perspective.  Think 
about  a  trader  at  a  trading  desk.  You  could 
ask  them,  “Do  you  know  what  your  convex¬ 
ity  is  today?” 

And  they’ll  be  able  to  tell  you,  with  fairly 
pinpoint  precision,  what  their  risk  is.  But 
they  still  get  an  analytic  that  tells  them  what 
their  convexity  is.  And  that  analytic  is  meant 
to  challenge  that  perspective  on  a  continu¬ 
ous  basis  because  there  will  be  events  where 
all  of  a  sudden  it  will  be  different  from  what 
the  trader  thinks,  and  the  trader  will  say, 


Evolve  to  Visual  Network  Troubleshooting 


Tracing  Cables 

Once  upon  a  time,  troubleshooting 
network  problems  stopped  at 
tracing  cables  to  the  right  ports. 


Command  Line  Interface 

Then,  CLI  inside  each  device 
provided  more  details,  but  the 
big  picture  was  difficult  to  see. 


Root  Cause  Analysis 

Next,  RCA  tools  aspired  to  shield  engi¬ 
neers  from  the  troubleshooting  process 
like  a  magic  black  box,  but  fell  short. 


"Whoa,  whoa,  whoa;  am  I  right?  Or  is  the 
model  right?”  And  you  know,  sometimes  the 
model  is  wrong,  it  needs  to  be  recalibrated. 
Sometimes  there  is  a  market  condition  that’s 
happened  that  they  didn’t  actually  fully 
appreciate.  And  that’s  a  good  way  to  describe 
how  this  would  be  used  by  a  CIO.  The  CIO 
would  look  at  this  as  a  way  to  say,  “I’m  about 
to  make  these  decisions,  and  I  understand 
and  appreciate  what  the  output  is  going  to 
look  like  because  I’ve  done  this  before.  But  it’s 
nice  to  actually  be  challenged  on  that,  either 
positively  or  negatively.” 

Peter,  you  said  complexity  increases 
costs,  and  decreases  flexibility  and  stabil¬ 
ity.  Is  the  model  helping  you  address  all 
three  areas  equally? 

LEUKERT:  Yes.  The  hardest  one  to  measure 
is  flexibility  because  that  in  itself  is  typically 
something  that’s  not  well  quantified.  But  on 
cost  we  have  run  correlation  analysis  and  see 
that  the  more  complex  an  application  domain 
the  higher  the  maintenance  cost.  There  is  a 
very  strong  correlation.  And  for  stability, 
because  we  measure  incidents  in  production 
and  help  desk  tickets,  we  also  see  a  strong 
correlation  of  complexity  to  incidents  in 
production-clear  improvements. 


Is  the  model  done  as  far  as  you’re  con¬ 
cerned,  or  is  this  an  evolutionary  process? 
LEUKERT:  I  think  of  it  as  Version  1.0.  There 
will  be  a  2.0  and  a  3.0  version.  I  think  it 
works.  It’s  applicable.  But  of  course  it  will 
evolve.  There  are  two  sources  of  evolution: 
One,  by  trying  it  and  working  more  with 
it,  you  will  generate  additional  insight  and 
maybe  find  additional  indicators  to  take  into 
account  and  learn  which  type  of  questions, 
what  part  of  the  model  are  the  most  relevant 
and  insightful.  And  then  of 
course  getting  data  from  involv¬ 
ing  other  institutions  will  help 
it  evolve,  will  give  additional 
insight. 

SMALL:  With  the  introduction 
of  any  analytic,  people  will  gain 
a  better  appreciation  for  the 
metric  over  time.  With  complexity,  an  orga¬ 
nization’s  IT  footprint  may  drive  a  very  high 
complexity  metric.  The  thing  that  will  be 
important  to  understand  is  how  decisions 
are  influencing  the  increase  or  decrease  of 
that  metric.  So,  a  given  company’s  baseline 
may  be  higher  than  normal;  does  that  make 
it  dangerous?  Not  necessarily.  You  start  out 
with  a  metric,  and  then  as  you’re  making 


decisions  for  the  future,  you  can  start  to  see 
how  you’re  influencing  complexity  going 
forward,  and  that  might  challenge  some 
ideas.  Before  we  assume  a  position  where 
we’re  increasing  complexity,  maybe,  we 
may  want  to  look  at  alternatives  that  might 
decrease  complexity. 

Any  hurdles  that  you  can  see? 

LEUKERT:  I  think  the  challenges,  as  always, 
are  more  on  the  human  side.  So  if  you  had  a 
model  that  confirms  that  gut  feeling,  people 
are  happy,  yes?  If  the  model 
suddenly  contradicts  your  gut 
feeling  that  your  architect  or 
some  chief  developer  has,  it 
will  be  a  tough  change-man¬ 
agement  process.  But  that’s 
normal.  And  the  other  risk,  of 
course,  is  over-engineering.  I 
mean,  for  each  of  the  input  parameters  in  the 
model  you  could  probably  write  a  disserta¬ 
tion,  but  you  don’t  need  a  real  100%.  You 
can  really  work  with  80-20  here  to  make 
management  decisions,  because  manage¬ 
ment  is  always  faced  with  uncertainty  and 
incomplete  information,  and  this  is  just  a  tool 
to  improve  your  decision  quality.  So  being 
pragmatic  is  also  important.  S 
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visualize. 


Visual  Network  Troubleshooting 

Today,  Dynamic  Diagram  enables 
a  new  era  of  troubleshooting- 
map-driven  troubleshooting. 


When  a  network  is  down,  what  separates  top  troubleshooters 
from  the  rest? 

Knowledge  of  the  network. 

For  the  first  time,  detailed  knowledge  of  your  network  can  be 
extrapolated  from  the  live  network  automatically,  and  fed  to 
troubleshooters  through  something  everyone  knows  how  to  use-a  map. 

Empowered  by  the  map-driven  troubleshooting  methodology,  engineers 
become  experts  of  every  part  of  the  network. 

Troubleshoot  from  a  map.  Troubleshoot  faster. 

To  learn  more,  visit: 

http://info.netbraintech.com/visual-troubleshooting 
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FREE  trials. 
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TREND  ANALYSIS 


6  ways  to  build  SDNs  without  OpenFlow 


►  Certification,  from  page  10 

Among  those  with  lower  salaries,  only 
4%  had  earned  it.  Microsoft  certs  were 
held  by  39%  overall,  and  the  CompTIA 
Network+  by  almost  one  quarter. 

Cisco  certifications  were  named  the 
most  valuable  —  leading  to  more  promo¬ 
tions,  new  jobs  or  pay  raises  than  any 
other.  But,  oddly,  Cisco  certifications  were 
also  named  among  the  least  valuable. 

“I  do  think  networking  certifications 
are  the  most  valuable  when  coupled  with 
some  real-world  experience.  I  wouldn’t 
have  gotten  my  last  two  positions  without 
them,”  Norborg  says.  “It  also  depends  on 
the  cert  itself.  CCNA  is  OK.  CCNP,  CCDA 
and  CCDP  are  better.  I’m  sure  CCIE  is  even 
better,  but  once  again,  they’d  be  suspicious 
of  a  very  young  person  with  one.” 

Security  certifications  also  came  in 
strong.  More  than  one-third  of  respondents 
had  one,  with  the  CompTIA  Security^  the 
most  common.  Among  respondents  mak¬ 
ing  more  than  $110,000  annually,  secu¬ 
rity  certifications  were  held  by  38%,  par¬ 
ticularly  the  CCSP,  earned  by  36%  of  this 
group.  In  comparison,  only  9%  of  those 
making  less  than  $110,000  had  the  CCSP 
but  32%  had  the  CompTIA  Security+. 

The  least  popular  certifications  were 
for  network  management  technology  — 
only  17%  of  our  700  respondents  had  one. 
While  network  management  is  often  cat¬ 
egorized  as  a  mid-level  job,  surprisingly, 
those  who  earned  the  biggest  salaries, 
more  than  $110,000,  were  far  more  likely 
to  have  one  (40%)  than  those  earning  less 
than  $110,000  (22%). 

Linux  certifications  and  sysadmin/ 
virtualization  certifications  came  in  as 
middle  of  the  pack  in  both  popularity 
and  value. 

Least  popular  of  all  were  certs  involv¬ 
ing  virtualization  technology  from  Citrix 
or  Red  Hat. 

Beyond  jobs  and  promotions,  some 
certification  holders  felt  that  certs  had 
other  value.  One  said,  “As  I’m  the  only 
member  of  IT  staff  here,  people  have 
become  aware  of  the  more  complicated 
jobs  I  perform  here,  having  seen  the  cer¬ 
tifications  I’ve  passed.” 

Of  survey  respondents,  27%  said  they 
chose  to  get  a  certification  simply  to  learn 
about  the  technology,  not  to  pocket  more 
dough.  While  no  one  argues  that  certs  are 
more  valuable  than  hands-on  experience, 
“they  can  be  helpful  when  implementing 
a  new  technology,”  Eddy  says.  “One  of  the 
things  I  like  to  negotiate  with  a  new  pur¬ 
chase  order  is  that  the  vendor  throws  in 
the  certification  on  their  product.”  ■ 


Command-line  interfaces 

CLIs  are  the  interfaces  common  to 
switches  and  routers,  which  network 
managers  use  to  configure  them,  and 
activate  or  deactivate  services. 

SNMP  Simple  Network  Management 
Protocol  can  be  used  to  modify  and  apply 
a  new  configuration  through  remote  mod¬ 
ification  of  configuration  information. 

XMPP  Extensible  Messaging  and 
Presence  Protocol  is  an  XML  streaming 
protocol  for  presence  and  messaging 
routing.  It  also  provides  a  secure  but 
easily  programmed  language  for  linking 
diverse  networks. 

Netconf  The  lETF’s  Netconf  is 
designed  to  reduce  the  programming 
effort  involved  in  automating  device 
configuration.  Netconf  would  use  XML  to 


►  OpenFlow,  from  page  11 
long  term,”  she  says. 

SDN  has  the  opportunity  to  be  ubiquitous, 
she  agrees.  But  whether  OpenFlow  will  be  the 
one  API,  or  OpenStack,  or  Netconf,  or  XMPP, 
or  VMware  or  another  hypervisor  is  difficult 
to  predict.  Ullal  says  they  all  promise  topol- 
ogy-agnostic  network  virtualization  opti¬ 
mized  for  application  and  workload  mobility. 

At  VMworld,  Arista  demonstrated  how  to 
build  clouds  with  one-touch  provisioning  of 
virtual  machines  and  up  to  50,000  network 
nodes  using  the  tools  in  its  EOS  operating 
system  software  and  CloudVision  interface. 
XMPP  is  the  API  in  CloudVision. 

“There’s  no  reason  tomorrow  it  couldn’t  be 
an  OpenFlow  or  OpenStack  API,”  Ullal  says. 
“But  here’s  a  well-defined  interface.  Today  we 
do  Netconf  and  XMPP  because  it  was  easy  to 
implement,  well-defined  specs  and  we  had 
some  customer  interest  there.” 

Ullal  says  Arista’s  EOS  will  support  a  suite 
of  APIs  for  different  “use  cases”  that  custom¬ 
ers  demand.  Right  now.  Arista  is  detecting 
initial  demand  for  OpenFlow  among  research 
institutions,  and  in  data  centers  to  redirect 
flows  to  taps  and  tap  aggregators. 

“One  new  technology  does  not  preclude  the 
pragmatic  approach  of  also  enhancing  existing 
technologies,”  she  says  with  regard  to  SDNs. 
“In  operational  environments  where  legacy 
prevails,  enhancing  existing  technologies  is 
even  more  important  than  innovation.” 


configure  devices  and  to  more  efficiently 
tap  state  and  configuration  data  stored 
on  devices. 

OpenStack  OpenStack,  the  Rack- 
space/NASA  open  source  software  for 
cloud  computing,  is  free,  modular  open 
source  software  for  developing  public 
and  private  cloud  computing  fabrics  and 
controllers. 

Virtualization  software  APIs 

APIs  in  hypervisors  and  other  virtualiza¬ 
tion  software,  such  as  VMware’s  vSphere, 
virtualize  server,  storage  and  network 
resources,  and  aggregate  and  allocate 
them  on  demand  to  applications.  They 
include  tools  to  define  resource  pools 
and  business  rules  for  service  levels,  and 
to  automate  the  enforcement  of  service 
levels  to  ensure  application  availability, 
performance,  security  and  scalability. 


Rather  than  OpenFlow  driving  SDNs, 
SDNs  will  drive  OpenFlow,  Ullal  believes. 

Forster  says  SDNs  would  not  have  the  buzz 
in  the  market  today  were  it  not  for  OpenFlow. 
And  with  myriad  APIs  each  tailored  for  a 
specific  “use  case,”  that  means  there  needs  to 
be  fewer  to  program  to. 

“In  many  of  the  programmability 
approaches  that  vendors  are  trying  the  APIs 
become  so  incredibly  specific  that  it’s  simply 
not  profitable  for  a  third-party  vendor  —and 
really  barely  worth  the  customer’s  time  — 
to  write  on  top  of  these  incredibly  specific 
APIs,”  he  says.  “There’s  a  fairly  broad  con¬ 
sensus  of  folks  realizing  that  unless  there’s  a 
baseline  of  standardization,  there’s  some  that 
will  never  create  an  ecosystem  of  third-party 
applications  for  this.” 

With  respect  to  XMPP,  Forster  says  it’s 
“clever”  but  doesn’t  mask  the  complexity  of 
automation  scripts  written  to  it. 

“XMPP  doesn’t  let  you  write  a  Perl  script 
that  can  roll  back  (unintended  commands),” 
he  says.  “The  Perl  scripts  that  you  write  on 
top  for  automation  still  end  up  being  pretty 
complicated.” 

But  what’s  not  debatable  is  the  visibility 
OpenFlow  is  bringing  to  SDNs,  and  vice 
versa. 

“OpenFlow  is  critical,  and  not  because  it’s 
the  answer,”  says  Andre  Kindness,  an  ana¬ 
lyst  with  Forrester  Research.  “It’s  one  of  the 
answers.”  ■ 
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CLEAR  CHOICE  TEST:  WAN  OPTIMIZATION 


ACCELERATION 


►  Cisco, from page  1 
operating  systems. 

For  this  exclusive  Clear  Choice  test,  we 
deployed  a  pair  of  WAVE-294  (Wide  Area 
Virtualization  Engine)  branch  office  appli¬ 
ances  and  a  pair  of  WAVE-8541  data  cen¬ 
ter  appliances.  We  used  Cisco’s 
default  optimization  settings, 
which  include  more  than  190  pre¬ 
defined  acceleration  rules. 

Our  first  goal  was  to  verify 
Cisco’s  claim  that  the  WAVE-8541 
can  handle  up  to  150,000  concur¬ 
rent  connections  and  not  drop  any 
packets  or  sessions.  We  created  a 
high-speed  network  in  the  lab  and 
cranked  up  the  traffic  with  a  pair 
of  Spirent  3100B  Avalanche  load 
generators. 

A  pair  of  WAVE-8541s  was 
directly  connected  via  10  Gigabit 
Ethernet  through  two  Cisco  Cata¬ 
lyst  6500  routers  on  the  WAN  side. 

The  LAN  side  was  also  10G  Eth¬ 
ernet  to  the  Spirent  device  with  a 
1  Gigabit  backbone  for  the  Central 
Manager  and  other  devices.  We 
monitored  the  connection  levels 
both  from  the  Spirent  console  and 
via  command  line  from  each  8541 
appliance. 

During  the  30-minute  test  run, 
the  connection  count  stayed  solid 
at  150,000  connections.  CPU  uti¬ 
lization  on  the  data  center-side 
WAAS-8541  peaked  at  approxi¬ 
mately  51%,  while  the  branch 
unit  never  exceeded  31%.  The 
8541  scaled  to  150,000  without 
any  issues  even  while  the  default 
set  of  WAN  optimization  policies 
were  enabled. 

Next,  we  tested  Cisco’s  claim 
that  the  WAVE-8541  appliance 
can  handle  2Gbps  of  optimized 
WAN  throughput.  Using  the  same 
network  setup,  we  created  traffic 
from  four  Ubuntu  clients  running 
iperf  connected  to  our  Gigabit 
LAN.  The  traffic  generated  by  iperf  was  a  mix 
of  50-50  compressible  and  uncompressible 
data.  With  all  four  clients  active,  the  LAN 
side  reported  approximately  3.96Gbps  of 
traffic  and  the  WAN  side  peaked  at  1.97Gbps. 
That  represents  some  of  the  best  performance 
we’ve  seen  based  on  previous  testing  of  WAN 
optimization  gear. 

New  cache  features 

In  the  past,  Cisco’s  cache  engine  on  the  data 
center  device  was  segmented  —  each  branch 


was  assigned  a  specific  portion  of  the  data 
center  appliance’s  cache  and  it  could  not  be 
shared  with  other  WAAS  appliances.  This 
meant  that  even  though  a  particular  block  of 
data  had  already  gone  through  the  data  cen¬ 
ter  to  one  location,  other  offices  couldn’t  take 


advantage  of  this  information. 

Cisco’s  new  context-aware  DRE  (Data 
Reduction  Engine)  does  away  with  the  seg¬ 
mented  cache,  opting  for  a  single  large  unified 
cache  that  all  appliances  can  participate  in. 

Cisco’s  DRE  adapts  to  changing  conditions 
in  traffic  and  applications.  For  most  everyday 
traffic,  HTTP,  CIFS,  NFS,  MAPI,  etc.,  the 
cache  operates  in  a  bidirectional  mode.  Sig¬ 
natures  and  byte  segments  are  located  at  both 
ends  of  the  connection  and  help  reduce  over¬ 
all  WAN  traffic  regardless  of  direction. 


What’s  interesting  is  that  DRE  can  also 
function  in  a  unidirectional  mode  for  specific 
traffic  types,  like  streaming  audio  and  video, 
and  VDI.  Because  the  traffic  is  one-way  from 
the  data  center  to  the  remote  end,  there  is  no 
need  to  cache  any  of  this  data  at  the  data  cen¬ 
ter.  Instead,  only  indexes  are  cre¬ 
ated  at  the  data  center  and  stored 
at  the  remote  site,  so  that  any 
subsequent  streaming  traffic  can 
take  advantage  of  any  cached  byte 
segments  in  the  branch  appliance 
without  filling  up  the  data  center 
cache. 

To  test  the  bidirection  and  uni¬ 
direction  functionality,  we  added 
a  pair  of  WAVE-294s  as  our 
branch  office  appliances  simulat¬ 
ing  two  locations.  We  connected 
to  a  SharePoint  server  and  file 
share  located  in  the  data  cen¬ 
ter  through  a  WAVE-8541,  and 
downloaded  and  uploaded  files 
into  each  system. 

We  were  able  to  monitor  the 
amount  of  data  stored  in  DRE  on 
both  sides  of  the  connection  and 
because  of  the  duplicate  nature 
of  the  files,  there  was  about  90% 
reduction  in  WAN  traffic.  Cach¬ 
ing  and  compression  are  common 
features  in  WAN  optimization 
devices,  and  it  is  always  nice  when 
the  systems  work  as  advertised. 

No  habla  UDP 

WAAS  does  not  optimize  or  cache 
UDP  traffic.  For  some  customers, 
this  could  be  a  critical  factor  when 
choosing  a  WAN  optimization 
solution.  While  most  day-to-day 
traffic  is  TCP,  there  is  a  growing 
amount  of  UDP  traffic  that  will  be 
ignored  by  WAAS. 

For  example,  Cisco  will  optimize 
and  accelerate  Citrix’s  HDX  and 
Microsoft’s  RDP  remote  access 
protocols  for  VDI,  but  VMware’s 
PCoIP  protocol  is  UDP  and  will 
simply  pass  through  the  appliance.  Also, 
some  backup  solutions  stream  data  to  stor¬ 
age  devices  using  UDP. 

The  software  engine  for  WAAS  is  the  same 
regardless  of  platform.  Not  all  features  are 
available  on  all  formats,  but  overall,  Cisco 
has  designed  a  consistent  user  interface  and 
feature  set  across  platforms. 

In  order  to  manage  your  WAAS  deploy¬ 
ment,  you  will  have  to  install  at  least  one 
Central  Manager  —  Cisco’s  WAAS  manage¬ 
ment  platform.  Available  in  both  virtual 
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and  physical  versions,  it  is  required  for  all 
WAAS  installations,  and  is  an  additional  cost. 
The  virtual  installation  is  only  available  for 
VMware  ESXi  or  Cisco  Unified  Computing 
System  appliances  and  one  Central  Man¬ 
ager  console  can  manage  up  to  2,000  WAAS 
devices.  We  found  the  browser-based  man¬ 
agement  UI  is  well  laid  out  and  very  intuitive 
to  use. 

Admins  assign  the  various  WAAS  instal¬ 
lations  into  logical  groups  and  apply  optimi¬ 
zation  policies  at  that  level.  If  the  situation 
requires,  admins  can  drill  down  and  override 
group  policy  at  the  single  device  level,  too.  An 
optimization  policy  is  made  up  of  an  applica¬ 
tion  classifier  and  an  action.  The  application 
classifier  is  the  component  that  tells  the  policy 
what  type  of  traffic  to  intercept,  for  example 
TCP  port  139  and  445  for  CIFS.  IT  can  create 
custom  classifiers  for  specific  traffic  types. 

The  action  is  what  determines  how  the 
traffic  is  manipulated,  and  there  are  nine  dif¬ 
ferent  actions  available.  From  pass-through 
to  TFO  (TCP  Flow  Optimization)  to  TFO 
with  DRE  and  LZ  data  compression,  WAAS 
covers  just  about  all  possible  scenarios.  We 
were  able  to  create  custom  policies  in  just 
minutes  and  easily  deploy  them  to  specific 
device  groups. 

All  hands  report 

A  big  benefit  of  managing  all  of  your  devices 
in  a  single  location  is  the  ability  to  view  the 
status  of  all  locations  at  a  glance  and  cre¬ 
ate  consolidated  usage  reports.  There  are 
a  number  of  reports  included  in  Central 
Manager,  such  as  traffic  and  optimiza¬ 
tion  summary,  HTTP,  HTTPS,  video,  SSL, 


MAPI  and  NFS  acceleration  reports,  and 
also  an  overall  acceleration  summary.  You 
can  generate  reports  on  a  specific  device,  if 
needed.  Unfortunately,  IT  cannot  create  any 
additional  types  of  reports,  such  as  charts 
and  statistics  on  a  customized  policy  for  one 
specific  traffic  type. 

We  like  that  Cisco  includes  Cisco  Prime,  its 
Network  Analysis  Module,  as  part  of  Central 
Manager.  Where  Central  Manager’s  report¬ 
ing  is  unique  to  WAAS  devices,  Cisco  Prime 
will  collect  network  statistics  from  all  across 
the  network,  including  non-WAAS  appli¬ 
ances.  This  allows  IT  to  get  a  complete  pic¬ 
ture  of  network  traffic  from  end  to  end  and 
not  be  limited  to  WAAS-only  information. 

Cisco’s  latest  release  of  WAAS  is  a  very 
mature  and  highly  scalable  platform  for 
speeding  up  TCP  traffic  in  the  enterprise.  Its 
lack  of  UDP  support  is  a  bit  disappointing, 
but  the  TCP  support  covers  just  about  every 
conceivable  situation.  We  like  the  Central 
Manager  console,  but  since  it  is  required  to 
manage  a  WAAS  deployment  —  and  is  an 
additional  cost  —  we’d  also  like  to  see  a  free, 
if  scaled  down,  version.  The  reporting  and 
monitoring  engine  is  top  notch  and  overall, 
we  found  the  system  easy  to  navigate  and 
use.  Most  of  all,  the  top-end  WAVE-8541 
is  an  absolute  speed  demon  and  its  ability 
to  handle  150,000  connections  and  pass 
2Gbps  optimized  traffic  over  the  WAN  is 
impressive.  B 

Schultz  is  head  of  NetData  Consulting 
Services,  and  an  InfoWorld  contributing 
editor.  He  can  be  reached  at  kschultz@ 
netdatacs.com. 


NETRESULTS  iiiiiiiiiiiifiif  i 

Product  Wide  Area  Application 
Services  4.4 


Company  Cisco 

Price  Hardware:  WAVE- 

294  -  $6,500;  WAVE- 
8541-  $235,000.  Central 
Management:  Virtual: 
VCM-2000N  (2,000  nodes) 
-  $24,000. 

Pros  Excellent  high-speed  WAN 

optimization:  centrally 
managed  and  monitored. 

Cons  No  UDP  support; 

required  management 
software  costs  extra. 


SCORECARD 

Itiillliilff f  lill 

WAAS  4.4 

Administration/ 

4 

Management  (25%) 

Installation/ 

4 

Compatibility  (25%) 

Reporting  (25%) 

4.5 

Scalability/ 

4.5 

Performance  (25%) 

Total 

4.25 

SCORING  KEY:  5:  EXCEPTIONAL;  4:  VERY 
GOOD;  3:  AVERAGE;  2:  BELOW  AVERAGE; 
1:  SUBPAR  OR  NOT  AVAILABLE 
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Grazing:  Better  browsing  under  iOS 


f  you  use  an  iPad  or  an  iPhone  and  you’re 
at  all  technical  you’ll  probably  have  a  love- 
hate  relationship  with  the  default  Safari 
browser.  The  problem  is  that  Safari  does  the 
job  but  it  just  seems  so,  well,  simplistic  and 
lacks  a  certain  desirable  “nerdiness.”  You  can 
do  all  sorts  of  cool  stuff  with  other  brows¬ 
ers  on  other  operating  systems,  but  Safari  on  iOS? 
Yawn.  But  I  have  an  answer! 


Mark  Gibbs’  Gearhead 


I  actually  first  covered  this  question  back 
in  July  in  my  now  defunct  Network  World 
Web  Application  Alert  newsletter  wherein 
I  waxed  lyrical  about  the  free  Grazing 
browser  published  by  Thinkbitz  Software 
Studio. 

With  Grazing’s  recent  upgrade  to  Ver¬ 
sion  2.1  and  the  release  of  a  related  OS  X 
app  called  Grazing  Push,  I  thought  it  well 
worthwhile  taking  another  look. 

As  I  wrote  way  back  when  I  was  some¬ 
what  younger,  the  Grazing  browser  “adds 
an  immediacy  and  fluidity  to  browsing  that 
creates  a  whole  new  experience” . . .  and  that 
wasn’t  hyperbole. 

While  the  overall  look  of  Grazing  is  famil¬ 
iar  (tabbed  browsing  windows,  favorites 
bar,  navigation  bar,  etc.),  the  browser  is  full 
of  really  sophisticated  features  that  make  it, 
by  far,  the  best  browser  I’ve  seen  on  iOS  yet. 

One  of  the  most  clever  things  about  the 
design  of  Grazing  is  that  it  recognizes  the 
ergonomics  of  using  a  pad  computer,  spe¬ 
cifically,  where  might  your  thumbs  be?  The 


answer:  on  either  side  of  the  device.  So  Graz¬ 
ing  takes  advantage  of  this  with  on-screen 
“pads”  rendered  as  pale  gray  outlines  on 
either  side  of  the  screen  that  you  use  by  slid¬ 
ing  your  thumbs  onto  the  pad  outlines.  You 
can  configure  which  of  two  types  of  pads  to 
use  and  how  large  they  are. 

The  “Slidepad”  provides  a  menu  of 
browsing  controls  so  you  can  go  forward 
and  backward  in  your  browsing  history, 
invoke  search,  close  and  open  tabs,  etc.  You 
simply  move  your  thumb  to  the  edge  of  the 
screen.  It  makes  for  a  very  different  way  of 
interacting  with  a  browser. 

The  other  type  of  pad  is  the  “Thumbpad,” 
which  provides  a  translucent  rectangular 
zone  down  the  side  of  the 
screen  that  allows  you  to 
scroll,  open  a  new  tab  in 
either  the  foreground  or 
background,  and  switch 
tabs. 

Grazing  also  supports  a 
number  of  gesture-based 


controls,  such  as  double  tapping  on  the 
Thumbpad  to  switch  tabs. 

But  wait!  That’s  not  all!  Grazing  slices, 
dices . . .  er,  sorry  I  got  carried  away ...  it  also 
has  a  “push”  feature.  Grazing  Push,  a  book- 
marklet  (that’s  a  small  JavaScript  script 
saved  as  a  browser  bookmark),  allows  you 
to  push  links  from  your  desktop  browser 
to  any  or  all  of  your  iOS  devices  running 
Grazing. 

The  newest  addition  to  Grazing  is  Graz¬ 
ing  Push  for  Mac,  a  free  experimental  tool 
that  works  in  the  opposite  direction  and 
sends  links  from  Grazing  on  your  iDevice 
to  your  default  browser  running  under  OS 
X  Lion. 

I’ve  been  using  the  Grazing  browser  for 
about  six  months,  and  as  I  wrote  above,  it’s 
one  of  the  best  browsers  I’ve  ever  used  (I’d 
say  it’s  on  a  par  with  Chrome  and  Firefox). 
The  functionality  is  outstanding,  it  is  fast, 
it’s  robust  (amazingly,  it  has  never  crashed 
on  me!)  and  it’s  free!  Grazing  gets  a  rating  of 
5  out  of  5!  WOOt!  H 

Gibbs  writes  in  Ventura,  Calif.  Your  thoughts 
to  gearhead@gibbs.com. 


I’ve  been  using  the  Grazing  browser 
for  about  six  months,  and  it’s  one  of 
the  best  browsers  I’ve  ever  used. 
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Indiana  Shaw  and  the  Gift  Guide  of  Doom 
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ON  PAGE  28  is  the  2011  version  of  our  technology 
holiday  gift  guide,  Cool  Yule  Tools.  Once  again  I  think 
we’ve  outdone  ourselves.  Online,  we’ve  got  somewhere 
between  150  and  170  reviews  of  different  products 
for  the  technology  and  gadget-lover  on  your  holiday 

Keith  Shaw’s 

gift  list.  Or  you  might  just  like  to  peruse  the  pages  Cool  Tools 

and  online  reviews  yourself  if  you  are  looking  for  ideas  to  make  your 
own  wish  list.  Since  all  of  my  energy  goes  into  producing  the  guide, 
the  column  this  week  will  not 
present  any  reviews,  but 
my  “Lessons  Learned”  from 
preparing  the  guide  and 
other  trends  I’ve  noticed 
Here  goes:  © 


►  Why  Indiana  Jones:  Some  may  wonder  what  Indiana  Jones 
has  to  do  with  the  holidays  and  gift  giving.  To  be  honest,  I  don’t 
know  either.  But  in  looking  at  the  products  we  tested  for  the 
guide,  we  went  beyond  the  obvious  choices.  So  many  other  maga¬ 
zines  and  websites  look  for  the  popular  items  —  if  you’re  looking 
for  a  comparison  of  smartphones  or  tablets  or  25  different  digital 
cameras,  this  isn’t  the  guide  for  you  (PC  World  does  a  great  job  of 
giving  those  reviews).  I  wanted  to  showcase  the  “hidden  gems,” 
the  “tech  treasures”  that  you  may  not  have  heard  about  or  read 
about  or  seen  dozens  of  times.  Hey,  I  love  the  iPad  2,  but  I  don’t 
think  you  need  to  see  yet  another  review  of  it. 

So  in  thinking  about  “gems”  and  “treasures”  and  “digging 
deeper,”  I  thought  of  Indiana  Jones,  and  coincidentally  this  year 
is  the  30th  anniversary  of  “Raiders  of  the  Lost  Ark.”  I  suppose 
I  could  have  chosen  paleontologist  instead  of  archeologist  — 
maybe  in  2013  I’ll  do  a  “Jurassic  Park”-themed  guide  (the 
20th  anniversary  of  that  film). 

►  Tablets  are  hot:  I  know,  tell  you  something  you  don’t 
know.  Last  year  the  iPad  hit  the  market,  but  we  didn’t 
see  a  whole  lot  of  accessories  geared  toward  it.  This 
year,  we  have  a  whole  category  of  d  ifferent  iPad 
accessories,  including  speaker  docks,  cases,  view¬ 
ing  stands,  keyboards,  etc.  When  you  get  a  pitch 
for  a  fake  paintbrush  that  can  help  you  paint 
pictures  better  on  your  iPad  (the  Nomadbrush), 
you  know  there’s  a  brand  new  market  category 
out  there. 

►  Pre-built  trumps  build-it-yourself:  Maybe 
this  is  a  generational  thing  (I’m  Gen  X),  but  if 
offered  two  products,  one  that’s  pre-built  vs. 
one  that  I  have  to  construct.  I’m  going  with  the 
pre-built  one.  Such  was  the  case  with  the  iCade 
from  ThinkGeek.  The  iCade  is  an  arcade  cabinet  that 
you  can  attach  your  iPad  to  and  reproduce  the  feeling  of  play¬ 
ing  video  games  from  the  '80s.  Only  issue?  You  have  to  build 
it  yourself.  Then  along  came  the  Atari  Arcade  from  Discovery 
Games,  already  pre-built  with  a  joystick  and  buttons  and 
everything  else.  Sure,  the  iCade  looks  better,  but  it  was  a  lot 
ier  to  test  the  Atari  Arcade  product. 

Inal  thoughts:  Enjoy  the  guide,  and  please  go  online 
(tiftyurl.com/724bbk9)  and  read  the  longer  write-ups:  A  lot 
of  hard  work  goes  into  producing  the  guide  each  year,  and  I 
couldn’t  do  it  without  the  awesome  assistance  of  my  “Cool  Yule 
Elves.”  See  you  next  year! 

Shaw  can  be  reached  at  kshaw@nww.com. 

Follow  him  on  Twitter:  @shawkeith. 
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Should  you  share  breach  information? 


YES,  COMPANIES  SHOULD  BE  REQUIRED 

to  share  breach  information.  It  is 
a  critical  first  step  in  defending 
ourselves. 

In  May  2011,  five  democratic  sena¬ 
tors  sent  a  letter  to  U.S.  Securities 
Exchange  Commission  Chairwoman 
Mary  Schapiro  asking  for  a  motion 
that  will  require  companies  to  dis¬ 
close  their  cyber  risk.  The  intent  is  to 
protect  investors  by  exposing  infor¬ 
mation  that  will  allow  them  to  make 
more  educated  decisions.  We  need 
similar  disclosure  requirements 
about  security  breaches  to  help  for¬ 
tify  our  defenses. 

Recent  data  breaches  are  a  result 
of  targeted  attacks  that  start  with  a 
malware  source  and  initial  infection. 
Once  inside,  the  program  calls  out  to  command  and  control  sys¬ 
tems  and  then  moves  laterally  through  the  enterprise,  infecting 
more  hosts  and  seeking  higher  levels  of  privilege  and  direct  access 
to  valuable  information.  Targeted  information  is  staged  and  exfil- 
trated  across  the  network  perimeter. 

By  definition,  every  targeted  attack  is  unique,  engineered  spe¬ 
cifically  to  infiltrate  organizations  and  steal  information,  but 
they  all  follow  similar  patterns  and  leave  trails. 

Collectively,  we  can  follow  these  footprints  and 
monitor  the  paths  the  bad  guys  use,  but  we  need 
to  share  information  about  each  breach  to  prevent 
future  attacks. 

Because  of  the  economic  potential,  we  know  that 
even  if  we  stop  one  attack  it  will  just  be  rerouted 
to  go  after  another  target.  The  only  way  to  battle 
these  adversaries  is  to  go  on  the  offensive,  and  that 
requires  sharing  knowledge  about  the  attacks  — 
and  the  knowledge-sharing  has  to  span  federal 
agencies  and  the  private  sector. 

As  an  initial  step,  the  government  needs  to  cre¬ 
ate  a  clearinghouse  of  information  that  corpora¬ 
tions  can  access  if  they  agree  to  follow  a  set  of  rigid 
reporting  requirements.  We  also  need  to  mandate 
that  corporations  provide  information  about 
breaches  to  this  clearinghouse.  All  information 
will  be  located  centrally  and  a  communication 
and  collaboration  process  will  be  put  in  place  to 
keep  track  of  each  foreign  fingerprint  found  on  a 
corporation’s  network. 


IF  A  CORPORATION  IS  TO  act  in  the  best 
interests  of  its  shareholders  there’s 
no  benefit  in  sharing  details  of  secu¬ 
rity  breaches  unless  the  disclosure 
is  required  by  law  or  doing  so  would 
help  curtail  the  financial  loss  for 
customers,  partners  or  others.  As  to 
there  being  a  fiduciary  responsibility 
to  disclose  a  breach,  this  continues  to 
be  a  gray  area  of  the  law. 

Exposing  details  of  your  data 
breach  could  damage  shareholder 
value  if  it  diminishes  the  corpora¬ 
tion’s  reputation  or  triggers  fines  and 
sanctions  from  regulators  and  indus¬ 
try  groups.  The  disclosure  might  also 
inhibit  the  organization’s  access  to 
capital  (both  private  and  public)  if  it 
raises  questions  about  corporate  gov¬ 
ernance.  Such  disclosure  may  also  trigger  both  frivolous  as  well  as 
well-founded  lawsuits. 

Recent  headlines  prove  that  any  organization  can  fall  victim, 
regardless  of  prior  investments  in  security.  And  because  so  many 
of  today’s  high-profile  attacks  seem  motivated  by  some  combina¬ 
tion  of  politics,  greed  and  ego,  the  disclosure  will  likely  fuel  more 
attacks. 

It  is  the  job  of  the  government  to  provide  clear 
guidance  as  to  breach  reporting  requirements  of 
corporations.  The  objectives  of  such  reporting 
should  be  to  provide  intelligence  to  law  enforce¬ 
ment,  assist  in  apprehending  the  perpetrator 
and  help  prosecute  the  crime.  Another  objective 
is  to  properly  assign  culpability  for  the  breach 
and  not  further  victimize  the  corporation  and  its 
customers. 

Unfortunately,  the  greed  of  our  various  state 
attorneys  general  can  result  in  further  punish¬ 
ment  of  corporate  victims  under  the  banner  of 
states’  rights.  Corporate  victims  find  themselves 
fined  by  states  for  the  crime  of  being  victimized  — 
the  justification  of  apparently  being  that  victim 
corporations  are  rich  enough  to  pay. 

And  prosecutors  seem  to  have  the  mistaken 
impression  that  it’s  always  within  corporations’ 
power  to  protect  private  data.  In  effect,  today’s  cor¬ 
porations  are  expected  to  erect  an  impenetrable 
defense  against  all  attackers  —  including  nation¬ 
state  funded  criminals  that  no  one  is  proven 


A  critical 
first  step 


Peter  George,  president 
and  CEO,  Fidelis  Security 
Systems 


In  a  sharing  mood? 

Yes,  corporations 
should  share  breach 
information  (74%) 


No,  we  can’t 
risk  frivolous 
lawsuits  (26%) 


Cast  your  vote  and 
see  comments  at 
tinyurl.com/7ypncl7 


Not  unless 
you’re 
forced  to 


Philip  Lieberman, 
president  and  CEO, 
Lieberman  Software 


►  See  George,  page  26 


►  See  Lieberman, page 26 
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Expand  your  IT  capabilities, 
not  your  real  estate. 


APC  by  Schneider  Electric  helps  you  deploy 
your  IT  whenever  and  wherever  you  need  it. 

Is  your  lack  of  IT  space  a  barrier  to  adopting  new  technologies? 
Consolidation,  virtualization,  network  convergence,  blade  servers— these  new 
technologies  improve  efficiency,  cut  costs,  and  allow  you  to  “do  more  with  less.”  But 
they  also  bring  power,  cooling,  and  management  challenges,  especially  when  you’re 
tasked  with  deploying  your  IT  without  dedicated  space.  You're  relying  on  guesswork, 
depending  on  building  air  conditioning,  or  improvising  remedies.  So,  how  can  you 
increase  the  level  of  reliability  and  control  of  your  server  deployment  without  spending 
a  fortune? 

The  availability  you  need-without  the  IT  room. 

APC  by  Schneider  Electric™  understands  the  challenges  of  delicately  matching  IT 
needs  with  iogistical  realities.  Fortunately,  we  have  adaptable  and  flexible  solutions 
that  provide  everything  for  your  IT  deployment:  reliable  and  efficient  power,  cooling, 
monitoring,  and  management.  Whatever  your  logistical  or  space  constraints,  we 
have  a  total  solution  to  meet  your  specific  needs.  All  components  have  been  pre¬ 
engineered  to  work  together  and  integrate  seamlessly  with  your  existing  equipment. 

Future-proof  your  IT  deployment. 

There’s  no  need  for  confusing  cooling  configurations  or  expensive  mechanical 
re-engineering,  so  our  modular,  “pay-as-you-grow”  designs  let  you  be  100  percent 
confident  that  your  IT  capabilities  can  keep  pace  with  ever-changing  demands. 
Self-contained  cooling,  high-density  enclosures,  rack-level  power  distribution  and 
monitoring  sensors,  and  integrated  management  software  provide  complete  remote 
control  and  unprecedented  visibility  into  your  entire  IT  system.  Simply  add  power 
protection  (such  as  undisputed,  best-in-class  Smart-UPS™  or  Symmetra™  units), 
and  you  have  a  total  solution  for  today,  tomorrow,  and  beyond. 


Learn  how  to  reduce  cooling  expenses  with 
our  FREE  Cooling  Efficiency  kit  and  enter  to 
win  1  of  5  Smart-UPS  units  (SMXIOOO)! 


Infra  ^truxure 

0  Enclosures  Vendor-neutral 
NetShelter™  SX  rack  design 
handles  high-density  airflow 
and  power  needs. 

Q  Power  Ultra-reliable  Smart-UPS 
and  Symmetra  UPS  units  offer 
scalable  runtime,  and  PDUs  are 
rack-mounted. 


^  Environmental  monitoring  and  management 

PoE-enabled  temperature  sensors  let  you  keep  an  eye 
on  conditions  at  the  rack  level,  and  centralized  software 
gives  you  real-time  insight  into  the  entire  system. 


Expand  your  IT  capabilities  without  building  out. 

The  unique,  soundproof,  self-contained  NetShelter  CX 
enclosure  solution  includes  everything  you  need  to  house  a 
highly  reliable  IT  deployment  regardless  of  space  limitations. 


Visitwww.apc.com/promo  Key  Code  j524v  •  Call  888-289-APCC  x6316  •  Fax  401-788-2797  by  Schneider  Electric 
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►  George,  from  page  24 

Companies  should  disclose  both  cyber  intrusions  and  the  foren¬ 
sics  about  such  intrusions.  This  is  essential  to  preventing  these 
attacks  from  compromising  the  viability  of  our  businesses  and  our 
national  security  interests. 

While  there  are  times  when  the  federal  government  and  private 
sector  come  together,  this  collaboration  needs  to  be  standardized. 
Today  the  government  might  warn  an  enterprise  about  suspicious 
activity,  and  leave  it  to  the  company  to  discover  what’s  going  on 
within  its  network.  But  that  company  is  not  required  to  circle  back 
to  verify  the  activity  and  share  what  was  learned  —  which  means 
no  one  is  the  wiser.  Why  not  disclose  the  information  collected? 

2011  will  be  remembered  because  of  Anonymous,  LulzSec  and 
hacker  collectives  that  came  together.  Hacker  groups  are  smart; 
they  collaborate,  and  we  need  to  do  the  same. 

While  it’s  thrilling  to  see  some  teamwork  on  this  front,  the  time 
has  come  to  put  the  effort  into  motion.  Right  now  the  bad  guys 
have  the  advantage. 

Changing  the  balance  of  power  requires  working  together  better, 
sharing  information  and  committing  to  a  better  security  posture 
by  innovating  technologies  and  improving  our  processes.  We  can¬ 
not  treat  breaches  as  individual  threats  anymore,  but  as  pieces  to 
a  larger  puzzle  that  will  someday  allow  us  to  detect  threats  before 
they  enter  our  networks. 

Pearl  Harbor  was  a  crystallizing  moment  that  proved  the  need 
for  sharing  military  intelligence.  In  hindsight  the  government 
learned  that  this  single  event  was  the  result  of  a  major  intelli¬ 
gence  lapse:  a  result  of  misleading  analysis,  collection  gaps  and 
adversaries  giving  false  information,  trying  to  muddle  in  the 
middle  of  it  all. 

In  the  cyber  world,  we’ve  had  a  series  of  smaller  crystallizing 
moments  that  are  serving  as  warning  signs.  We  shouldn’t  need 
a  crippling  event  like  Pearl  Harbor  to  prod  us  into  action.  We’re 
seeing  signs,  so  we  cannot  sit  back  and  wait.  Data  breaches  can  be 
prevented  with  appropriate  analysis,  information  and  collabora¬ 
tion,  and  sharing  information  is  the  first  step  in  understanding 
and  preventing  future  breaches.  H 

Since  2002,  Fidelis  Security  Systems  has  been  providing 
organizations  with  the  network  visibility,  analysis  and  control 
necessary  to  manage  advanced  threats  and  prevent  data 
breaches. 

O  Send  Debate  Suggestionstojdix@nww.com 


►  Lieberman,  from  page  24 
capable  of  defeating. 

The  federal  government  has  proposed  rules  whereby  corpora¬ 
tions  would  receive  immunity  from  prosecution  if  they  promptly 
informed  law  enforcement  about  breaches  and  helped  capture  and 
try  the  perpetrators. 

State  and  federal  governments  also  should  do  a  better  job  of  issu¬ 
ing  specific,  actionable  security  standards  to  help  shield  compliant 
organizations  from  attack. 

Evolving  standards  like  the  Consensus  Audit  Guidelines  are  a 
start,  and  the  recent  Securities  and  Exchange  Commission  guid¬ 
ance  is  encouraging;  however,  until  now  federal  and  state  govern¬ 
ments  have  done  too  little  to  promote  standards  like  these. 

For  corporations  the  lack  of  actionable,  unambiguous  cyber 
security  standards  effectively  means  that  doing  nothing  and 
doing  everything  possible  could  have  equal  weight  to  a  judiciary 
unschooled  in  information  technology  —  or  to  prosecutors  hell¬ 
bent  on  filling  empty  state  coffers. 

The  lack  of  actionable  corporate  security  requirements  —  and 
the  fact  that  there  is  no  safe  harbor  for  organizations  that  disclose 
data  breaches  and  cooperate  with  prosecution  —  creates  a  perverse 
scenario  where  it’s  simply  not  in  a  corporation’s  interest  to  divulge 
any  more  than  is  required  by  law.  In  fact,  it  can  be  argued  that  a  cor¬ 
porate  officer  who  discloses  more  than  the  legal  minimum  ought 
to  be  terminated  for  disregarding  the  organization’s  responsibility 
to  its  shareholders. 

It  is  about  time  that  the  federal  government  publish  its  guide¬ 
lines  for  the  disclosure  of  public  breaches  and  spell  out  how  cor¬ 
porations  can  protect  themselves  from  prosecution  by  “doing  the 
right  things.” 

I  also  believe  that  litigating  against  a  corporation  (whether  a 
public  or  private  action)  that  has  taken  reasonable  care  to  protect 
its  systems  is  both  counterproductive  and  vexatious.  But  of  course, 
this  doesn’t  stop  some  attorneys  from  “making  hay”  while  the  sun 
of  ambiguous  guidance  still  shines. 

It’s  time  for  the  federal  government  to  put  unscrupulous  law¬ 
yers  that  attack  breached  companies  out  of  business  and  allow 
corporations  to  do  the  right  thing  by  disclosing  breaches  without 
punishment.  Today,  however,  companies  should  not  share  breach 
information.  B 

Lieberman  Software  provides  privileged  identity  management 
and  security  management  solutions  to  customers  worldwide, 
including  40%  of  the  Fortune  50. 


Companies  are  beholden  to  customers 
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©  The  recent  Sony  breach  is  a  good 
example  of  holding  companies  respon¬ 
sible.  Companies  have  the  responsibility 
of  protecting  the  confidentiality/privacy 
Of  customer  information.  And  if  there  is  a 
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•  breach,  the  customer  absolutely  has  a  right 


to  know  if  they  were  breached.  Yes,  fallout 
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protect  the  information  in  the  first  place. 

I  absolutely  believe  that  breached  indi¬ 
viduals  have  the  right  to  timely  notification. 
Delays  are  unacceptable,  and  hiding  it  is 
unthinkable.  Afflicted  people  deserve  quick 
notification  so  they  can  ensure  their  credit 
report  isn't  showing  strange  activity  and 
that  their  Social  Security  number  isn't  be¬ 
ing  used  to  open  new  credit  cards  or  being 
used  to  fraudulently  report  wages.  Taking 


it  one  step  further,  mandatory  disclosure 
would  provide  the  structure,  discipline  and 
enforcement  required  for  consistent  and 
transparent  breach  information.  Compli¬ 
ance  would  require  a  very  high  level  of 
visibility  and  control  of  all  files  that  enter, 
bounce  around  and  exit  an  organization. 
This  would  benefit  not  only  breached 
individuals,  but  also  the  organizations  and 
their  business  partners,  hughgarber 
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Sensaphone  Remote  Monitoring  Products 

use  redundant  communication  paths,  built  in  battery 
backup,  and  supervised  sensors  to  make  sure  that  when 
something  goes  wrong  in  your  computer  room 
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Get  your  FREE  application  guide  now 


SENSAPHONE’  877-373-2700 

REMOTE  MONITORING  SOLUTIONS  www.sensophone.com 
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Desktop  with  Spider 


Network  with  Spider 
Publish  (portable  media) 
Web  with  Spider 
Engine  for  Win  &  .NET 
Engine  for  Linux 


dtSearch* 


The  Smart  Choice  for 
Text  Retrieval®  since  1991 


Instantly  Search  Terabytes  of  Text 


- — - -  X 

Highlights  hits  in  a  wide  range  of  data,  using  dtSearch's 
own  file  parsers  and  converters 

•  Supports  MS  Office  through  2010  (Word,  Excel,  PowerPoint, 
Access),  OpenOffice,  ZIP,  HTML,  XML/XSL,  PDF  and  more 

•  Supports  Exchange,  Outlook,  Thunderbird  and  other 
popular  email  types,  including  nested  and  ZIP  attachments 

•  Spider  supports  static  and  dynamic  web  data  like  ASP.NET, 
MS  SharePoint,  CMS,  PHP,  etc. 

•  API  for  SQL-type  data,  including  BLOB  data 

25+  full-text  and  fielded  data  search  options 

•  Federated  searching 

•  Special  forensics  search  options 


With  dtSearch:  "Endless 
indexing  is  now  a  breeze" 

Computerworld 

"Impressive  searching 
power ...  handles  more 
than  a  terabyte  of  text  in 
a  single  index" 

Network  World 


"Lightning  fast  ... 
performance  was 
unmatched  by  any  other 
product" 

Redmond  Magazine 


Ask  about 

fully-functional 

evaluations! 


•  Advanced  data  classification  objects 

APIs  for  C++,  Java  and  .NET  through  4.x 

•  Native  64-bit  and  32-bit  Win  /  Linux  APIs;  .NET  Spider  API 

•  Content  extraction  only  licenses  available 


For  hundreds  more 
reviews  and  developer 
case  studies,  see 
www.dtSearch.com 


www.dtSearch.com  •  i-soo-it-finds 
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BY  KEITH  “INDIANA”  SHAW 

AND  THE  COOL  YULE  ELVES  ^ 

Hello,  folks,  k:i 

Indiana  Shaw  check¬ 
ing  in  here.  Just  like  my 
more  famous  archeolo¬ 
gist  cousin  who  digs  up 
ancient  artifacts  and  trea¬ 
sures  from  around  the 
globe,  I’m  proud  to  say 
that  we  scour  the  globe 
and  the  Internet  to  dig  up 
the  greatest  technology 
treasures.  As  the  holidays 


The  best  Internet-connected 
TV  set-top  box  gets  better 
year  after  year.  This  year's 
model  features  a  much  smaller 
size,  the  ability  to  connect  to 
multiple  Internet  TV  services 
(Netflix,  Amazon  on  demand, 
Hulu  Plus,  NBA  and  NHL  TV 
and  more!),  and  the  ability  to 
play  Angry  Birds  via  a  gesture- 
controlled  remote  control. 


Griffin  HeloTCiOS 
helicopter  $50 

Remote-controlled  flying  toys 
not  necessarily  a  new  invention, 
but  when  you  can  control  the  cop¬ 
ter  with  your  iPhone,  iPad  or  iPod 
Touch,  that  changes  things.  With 
infrared  signaling,  you  can  control 
the  helicopter's  throttle  and  elevation 
with  your  thumbs,  and  steering  via 
the  phone’s  accelerometer. 


are 


Roku2XS  $100 


approach,  we’re  opening 
up  our  satchel  to  tell  you 
about  some  great  “dia¬ 
monds  in  the  rough” 
that  we’ve  discovered 
—  presented  on  the 
next  few  pages  are 
our  picks  for 
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headphones  $40 

You  may  think  an  over-the- 
head  style  for  headphones 
is  too  bulky  or  uncool,  but 
banish  those  thoughts.  Why? 
The  CS40S  headphones  are 
amazingly  comfortable. 

-  Wear  these  for  hours 
and  you’ll  never  get 
ear  fatigue  that 
you  get  with  other 
|  headphones,  plus 
the  40mm  bass 
/driver  will  make 
your  music  sound 


Apple  MacBook  Air  $1,300  (as  tested) 

If  you’ve  never  considered  a  Mac  before,  or  are  turned  off  by 
the  price  (there  are  other  notebooks  that  are  cheaper), 
the  best  reason  to  change  your  mind  is  the  latest 
MacBook  Air.  The  light  (under  3  pounds), 
fast  (1.7GHz  dual-core  i5  with  4GB 
of  RAM  and  128GB  of  storage)  and 
slick  notebook  will  make  you  (or 
your  giftee)  very  happy  during  the 
holidays. 
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Fanny  Wang 
On-Ear  Luxury 
headphones  $115-$170 


She  s  not  a  real  person,  in  case  you  1 

were  wondering,  but  rather  an  “iconic 
representation  of  the  merging  of  technol¬ 
ogy  and  fashion."  Anyway,  if  you're  looking 
for  a  great  pair  of  headphones  that  will  let 
you  crank  up  the  bass  without  losing  the 
sound-muffling  capabilities,  along  with  a 
great  fit,  you  should  check  these  out.  Bonus 
l  points  if  you  don’t  giggle  when  you  talk 
L  about  them  with  your  friends. 
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ioSafe 

Rugged  Portable  hard  drive  $i99-$399 

Most  people  will  never  run  into  the  extreme  conditions 
that  this  external  hard  drive  can  survive,  but  it’s  nice 
to  know  that  your  data  is  safe  should  you  ever  find  it 
crushed,  dropped,  placed  in  water  (up  to  20  feet), 
on  fire  or  shot  at  with  a  shotgun.  The  solid  alumi¬ 
num  (or  titanium  on  some  models)  casing  provides 
outstanding  protection,  and  the  company  offers  data 
recovery  services  up  to  $5,000  should  something 
actually  go  wrong. 


ThinkGeek’s  My  First 
Bacon  plush  figure  $15 

Any  true  fan  of  the  Internet  knows  that 
bacon  makes  everything  better.  Why  not 
show  that  love  with  My  First  Bacon,  a 
plush  figure  that  tells  you  what  it  is  (“I’m 
bacon!”)  at  the  push  of  a  button.  Not 
much  tech  here,  just  pure  bacon  fun. 


Discovery  Bay 
Games  Atari 
Arcade 

$59.99 

If  you  miss  the  excitement 
and  action  from  the  early 
’80s  in  those  classic  Atari 
video  games,  you  can  relive 
them  without  dumping 
quarter  after  quarter  into 
a  machine  —  instead,  pop 
your  iPad  into  this  docking 
station  and  get  four  buttons 
and  a  joystick  along  with  the 
Atari’s  Greatest  Hits  app  and 
relive  your  youth. 


iHealth  Blood 
Pressure  Dock  $ioo 

If  the  holidays  give  you 
stress  or  if  you  need  to 
check  your  blood  pressure 
on  a  regular  basis,  why 
not  use  your  wicked  cool 
iPhone  to  help  you  out? 
This  cuff  and  dock  system 
connects  to  your  iPhone  to 
provide  regular  blood  pres¬ 
sure  readings,  which  you 
can  then  track  and  report 
back  to  your  doctor. 


Samsung  Galaxy 
Tab  10.1  with  Verizon 
Wireless  4GLTE 
service  $530  (plus  data) 

If  you're  looking  for  a  tablet 
that’s  not  an  IPad  2,  this 
Android-based  wireless  tablet 
should  be  on  your  list.  From 
a  technical  standpoint,  it’s 
got  many  of  the  same  (if  not 
better)  features  and  specifica¬ 
tions  as  the  Apple  competitor, 
and  there  should  be  enough 
apps  within  the  Android  Mar¬ 
ketplace  to  satisfy  your  needs 
to  customize. 
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EPSON 


Epson  MegaPlex  MG- 
850HD  projector  $799 

Sure,  you  could  project  things 
like  PowerPoint  presentations 
on  this,  but  we  prefer  project¬ 
ing  movies  and  TV  shows  from 
our  iPad  onto  a  larger  wall  or 
screen.  The  720p-supported 
projector  provides  a  great 
picture  and  built-in  dock 
streams  from  an  iPhone,  iPod 
or  iPad  as  well  as  PCs/Macs 
or  even  a  USB  drive.  It’s  a 
great  combination  of  personal 
and  business  use  scenarios  in 
a  stylish,  all-in-one  package. 


Jawbone  Jambox 

$200 


Is  that  some  kind  of  chubby 
alien  about  to  attack  me? 

No,  it’s  the  iGuy,  a  fun  and 
colorful  (and  somewhat 
protecting)  iPad/iPad  2 
case  from  Speck  Prod¬ 
ucts.  The  foam  case  can 
stand  on  its  “legs"  and 
has  two  "arms"  that 
users  (OK,  your  kids) 
can  hold  onto  for  extra 
support  when  they’re 
using  your  iPad.  Three 
color  choices  (blue,  orange 
or  the  Gumby-like  green)  let 
you  stylize  it  even  more. 


Bluetooth  speaker  systems 
come  and  go,  but  never 
before  have  we  found  one 
that  produces  great  sound, 
and  is  extremely  portable  and 
oh-so-stylish.  The  Jambox 
will  play  music  wirelessly 
from  your  phone  and  provide 
great  sound  for  games  or 
movies  from  your  iPad,  and 
when  a  call  comes  in,  it  turns 
into  a  speakerphone  with 
360-degree  sound  and  built- 
in  microphone. 


Acer  Aspire  TimelineX 
(model  AS3830T-6417) 
notebook  $598  (as  tested) 


If  you  need  or  require  a  Win¬ 
dows  7  notebook  rather  than 
a  Mac,  you  can’t  go  wrong 
with  this  Acer  model.  This 
notebook  is  thin  (about  1  inch 
thick),  light  (about  4  pounds) 
and  fast  (2.1GHz  Intel  i3 
processor,  4GB  RAM,  500GB 
hard  drive).  The  inclusion  of 
an  HDMI  port  and  USB  3.0 
port  makes  it  a  rarity,  but 
a  good  one,  among  today’s 
notebooks. 


Columbia  Omni-Heat 
Electric  Jacket  $850 

Forget  about  normal  winter 
jackets  —  this  one  keeps  you 
warm  as  well  through  the 
power  of  electricity!  It’s  like 
an  electric  blanket  that  you 
can  wear  out  in  public. 


Diamond  Multimedia 
V-Stream  $107 

One  of  the  coolest  ways  to 
stream  content  from  your 
PC  to  a  TV  is  this  system. 
Plug  the  transmitter  into  a 
computer's  USB  port,  plug 
the  receiver  into  an  HDMI 
port  on  your  TV,  and  your  TV 
becomes  a  projector  for  your 
computer.  This  lets 
anyone  watch  Internet 
TV  services  on  their 
TV.  The  small  size  also 
makes  it  great  for 
travelers. 
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Looxcie  2  wearable 
video  camera  $150 

Many  wearable  video  cam¬ 
eras  aim  to  let  you  film  your 
action,  but  the  Looxcie  is  a 
bit  different  —  instead,  it  lets 
you  share  the  events  you’re 
watching  with  other  people. 
The  system's  new  Looxcie 
Live  app  lets  you  broadcast 
live  to  friends,  who  can 
watch  what  you’re  watching 
via  this  wearable  headset 
with  480p  video  resolution. 
For  grandparents  and  other 
family  who  can’t  attend 
special  events,  they  can  now 
"be  there  live”  when  it  hap¬ 
pens  via  the  Looxcie  2. 


Seagate  GoFlex 
Satellite  external 
hard  drive  $200 

This  external  hard  drive  pro¬ 
vides  storage,  but  the  wire¬ 
less  connectivity  provides  a 
lot  more.  With  an  associated 
iPad  app,  you  can  store 
much  more  of  your  media  on 
the  Satellite  instead  of  the 
internal  iPad  storage  (letting 
you  buy  a  less  expensive 
model),  and  then  stream  it  to 
the  iPad  from  there.  It’s  also 
great  for  streaming  content 
to  an  iPad  while  in  the  car  or 
on  a  jungle  trek. 


Charging  Station  i4 

$60 

As  more  homes  collect 
multiple  smartphones, 
music  players  and  other 
gadgets,  keeping  the  bat¬ 
teries  charged  becomes  a 
nightmare  of  power  cable 
clutter.  This  docking  station 
frees  up  the  cable  by  provid¬ 
ing  removable  power  tip 
adapters  that  allow  for  up  to 
four  devices  to  be  recharged 
at  once  without  the  unsightly 
cables. 


Bluetooth  car 
speakerphone  $70 

Every  other  Bluetooth  car 
speaker  phone  we've  seen 
is  a  flat  square  device  that 
attaches  to  the  driver's  side 
visor.  That’s  fine,  but  if  you 
want  to  have  some  more  fun 
yet  still  have  the  same  cool 
technology  from  a  Bluetooth 
speaker  phone,  check  out  the 
Speaky.  It  looks  like  a  tiny  fat 
baby  (or  comics  character 
Ziggy),  but  inside  it  has  the 
latest  tech  to  keep  your  hands 
free  for  driving  while  talking 
on  the  phone. 


Sonos  Play:3  Internet  speaker 
system  $299 

This  multiple-room  speaker  and  Inter¬ 
net  music  system  once  cost  thousands 
of  dollars,  but  the  price  has  gone  down 
and  the  technology  has  improved.  Play  any  music  from 
practically  anywhere  around  the  world  (including  Internet  music 
services)  or  from  your  own  home  (access  your  entire  library).  The 
built-in  speakers  produce  amazing  sound,  and  you  can  connect 
multiple  speakers  to  the  network  for  multi-room  coverage. 


That’s  just  a  sneak  peek  at  all  of  the  gems 
we’ve  uncovered  for  this  year’s  guide. 

Head  on  over  to  our  website  at  NetworkWorld.com  to  discover 
even  more  TECH  TREASURES,  SLIDESHOWS  and  VIDEOS 
for  the  holidays.  ©  tinyurl.com/724bbk9 


Cool  Yule  Elves:  C.J.  Mathias,  Jennifer  Finn,  Dan  Hunt,  Armen  Brown, 
Tom  Lupien,  Ken  Mingis,  Jodie  Naze,  Melissa  Shaw,  Neal  Weinberg,  Abigail  Weinberg 


Washington,  D.C. 


At  IT  Roadmap  Conference  &  Expo,  you’ll  discover 


December  7,  2011 

8:15am  -  4:30pm 
Washington  Convention  Center 


everything  you  need  to  know  to  make  informed 
technology  decisions  for  the  year  ahead  -  in  just 
one  day.  And  we’re  coming  to  Washington,  D.C.! 


Register  today! 

www.itroadmap.net/2011dcad 


Coming  soon 
IT  ROADMAP  2012 


Through  ROI  workshops,  technical  tutorials, 
strategy  sessions,  roundtable  discussions, 
keynote  addresses,  networking  opportunities 
and  an  interactive  expo  floor,  you’ll  hear  fresh 
perspectives  and  new  technology  insights  from 
the  industry's  leading  IT  analysts,  top  tech 
practitioners,  and  experienced,  high-profile 
end  users. 


New  York  City 
Chicago 
Denver 


All  new  morning  tracks  include: 

•  The  New  Data  Center 

•  The  Connected  Enterprise 


To  learn  more,  visit: 


L 


www.itroadmap.net/2011dcad 


•  The  Modern  Network 

•  The  Public  &  Private  Cloud 

•  The  Evolving  Threat  Landscape 

Who  Attends: 

•  CIOs  &  VPs 

•  Directors  of  IT 

•  IT  Managers 

•  Architects  &  Engineers 


For  more  information  about  sponsorship 
opportunities  and  benefits 

Contact  Andrea  DAmato.  Vice  President  and 
Publisher  of  Network  World,  at 
adamatofdnww.com  or  508-766-5455. 
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Apple  and  jail  made  cool 


WHEN  STEVE  Jobs  passed  away  early  last 
month  there  was  a  remarkable  outpouring 
of  grief  along  with  countless  articles  that 
sliced  and  diced  the  man,  his  history,  his  achievements  and  his  impact 
on  the  world.  The  majority  of  these  articles  were  laudatory,  focusing 
as  they  did  on  his  remarkable  drive  and  demand  for  perfection  and  for 
what  you  might  call  his  “uncompromising”  management  style. 

The  reality  is  that  it  will  take  a  long  time  to  objectively  place  Jobs’ 
achievements  in  context ...  that’s  simply  how  the  art  of  history  works. 

Even  so,  while  most  of  the  commentary  on  Jobs  was  positive  there 
were  a  few  notable  exceptions  and  one  of  these  in  particular  stood  out: 
The  obituary  written  by  Richard  M.  Stallman,  software  freedom  activ¬ 
ist,  computer  programmer  and  iconoclast. 

Stallman  is  the  creator  of  the  GNU  Project  without  which  Linux 
would  not  exist,  founder  of  the  Free  Software  Foundation  and,  argu¬ 
ably,  the  man  who  created  the  free  software  movement. 

The  Los  Angeles  Times  described  Stallman’s  commentary  as  a  “eulogy” 
which  was,  according  to  most  dictionaries,  definitely  not  the  case. 

What  Stallman  wrote  was,  “Steve  Jobs,  the  pioneer  of  the  computer 
as  a  jail  made  cool,  designed  to  sever  fools  from  their  freedom,  has  died 
...  we  all  deserve  the  end  of  Jobs’  malign  influence  on  people’s  comput¬ 
ing.  Unfortunately,  that  influence  continues  despite  his  absence.  We 
can  only  hope  his  successors,  as  they  attempt  to  carry  on  his  legacy, 
will  be  less  effective.” 

In  a  follow-up.  Stallman  expanded  his  argument:  “The  important 
thing  about  Jobs  is  what  he  directed  Apple  to  do  to  those  who  are  still 
living:  to  make  general-purpose  computers  with  digital  handcuffs 


more  controlling  and  unj  ust  than  ever  before ...  Jobs  saw  how  to  make 
these  computers  stylish  and  smooth.  That  would  normally  be  positive, 
but  not  in  this  case,  since  it  has  the  paradoxical  effect  of  making  their 
controlling  nature  seem  acceptable.” 

In  various  discussions  with  friends  in  the  computer  world  I’ve  been 
struck  by  how  many  of  them  share  Stallman’s  sentiments,  although 
how  the  Stallman’s  comments  are  interpreted  can  be  interesting.  Some¬ 
one  pointed  out  that  Dave  Winer  contends  “when  Stallman  says  that 
Jobs  made  computers  that  put  users  in  a  tightly  controlled  box  (‘jail 
made  cool’),  he  is  being  respectful,”  which  I  don’t  think  was  the  case  at 
all  when  it’s  followed  by  “designed  to  sever  fools  from  their  freedom.” 

What  is  really  behind  the  criticism  is  a  huge  nerd  dislike  of  the  Apple 
Zeitgeist:  the  structure,  the  unashamed  profit-making,  and  the  desire 
to  control  their  market.  And  the  nerds  are  right,  all  those  attributes 
exist,  but  imagine  a  world  without  Apple.  Which  company  would  have 
stood  up  and  dominated?  Microsoft?  Sony?  Dell?  Would  that  have  been 
better? 

For  all  the  criticism  we  can  heap  upon  Apple  and,  by  extension,  on 
Steve  Jobs,  the  Jail  Made  Cool  was  something  that  matters  immensely 
in  defining  how  we  think  of  end  user  computing. 

I’d  never  argue  that  OS  X,  iOS  and  the  Apple  market  are  without  faults 
but  I  contend  that  what  Apple  and  Jobs  did  was  set  the  bar  for  usability 
much  higher  than  any  other  company  has  ever  done.  Microsoft  might 
have  made  computers  usable  but  Apple  has  made  them  both  usable  and 
beautiful.  If  that’s  what  handcuffs  look  like,  I’m  to  be  a  fool.  ■ 

Your  take  to  backspin@gibbs.com. 
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Half  believe  social  media  sites  hurt  youth? 


I F  T  H  E  results  of  a  recent  telephone  survey 
are  to  be  taken  at  face  value  —  a  reason¬ 
ably  big  if,  in  my  opinion  —  roughly  half  of 
American  adults  believe  that  Facebook,  Twitter  and  their  ilk  are  harm¬ 
ful  to  the  social  development  of  today’s  young  people. 

The  survey  of  1,200  registered  voters  by  Poll  Position,  conducted 
Nov.  13  via  telephone  using  Interactive  Voice  Response  technology, 
asked  the  loaded  question:  “Do  you  think  that  social  media  are  helpful 
or  harmful  to  the  social  development  of  today’s  youth?” 

The  results:  53%  answered  “harmful,”  20%  said  “helpful,”  17%  said 
it  is  “not  making  a  difference”  and  10%  offered  no  opinion. 

You  say  you’ve  never  heard  of  Poll  Position?  Neither  had  I,  so  I’m 
inclined  to  be  wary  here,  but  the  results  are  eye-catching  if  for  no  other 
reason,  but  they  remain  remarkably  consistent  across  age  groups  — 
even  46.5%  of  those  18  to  29  said  they  consider  social  media  harmful.  In 
fact,  the  general  consensus  only  diverges  significantly  when  accounted 
for  by  the  respondent’s  political  party  affiliation:  more  Republicans 
(65%)  see  harm  from  social  media  than  do  Democrats  (40%). 

Of  course,  the  question  itself  strikes  me  as  questionable.  You  might 
as  well  ask:  “Have  you  heard  and  read  more  scary  stories  or  more  posi¬ 
tive  stories  about  social  media?” 

Poll  Position  makes  no  bones  about  the  fact  that  it  is  in  the  business 
of  asking  provocative  questions.  Relaunched  recently  by  former  CNN 
news  executive  Eason  Jordan,  the  site  takes  what  it  contends  are  sci¬ 
entifically  valid  polls  and  offers  registered  users  an  opportunity  to 
answer  the  same  questions  in  non-scientific  online  surveys.  The  side- 
by-side  presentation  offers  at  least  the  potential  of  interest. 


So  just  out  of  curiosity,  I  registered  at  Poll  Position  in  order  to  vote  in 
and  see  the  results  of  the  online  survey  asking  about  social  media.  The 
results  were  even  more  stark,  as  fully  60%  (of  an  unspecified  number 
of  respondents)  indicated  they  believe  social  media  is  a  detriment  to 
childhood  social  development. 

For  the  record,  I  don’t  believe  social  media  is  harming  the  youth 
of  America.  But  that’s  easy  for  me  to  say,  because  my  kids  are  still  too 
young  for  Facebook. 

Speaking  of  young  people 

A  recent  item  here  about  the  FBI  allegedly  using  “FBI  Van  1”  as  a  Wi-Fi 
SSID  (almost  certainly  a  joke)  elicited  this  anecdote  from  David  Hen¬ 
derson,  technology  coordinator  for  the  Southwest  Arkansas  Educa¬ 
tion  Cooperative: 

“A  group  of  kids  from  one  school  district  grabbed  a  laptop  and  a 
Wi-Fi  finder  app  and  started  driving  around  town.  Every  open  Wi-Fi 
spot  they  found,  they  attempted  to  use  the  default  username/password 
from  a  list  of  known  logins  for  various  AP  makers.  Once  logged  in,  they 
changed  the  SSID  of  any  box  they  could  access  to  a  three-letter  acronym. 
Before  the  day  was  over,  they  had  managed  to  create  a  city  wide  Wi-Fi 
network  based  on  the  acronym.  You  could  drive  almost  anywhere  and 
never  lose  your  connection  as  (your  laptop)  was  just  handed  off  from 
AP  to  AP.  It  was  great  fun.  Of  course,  people  caught  on  and  changed 
their  SSIDs  and  added  security,  which  was  kind  of  the  point.” 

I’m  guessing  it  was  more  the  fun  than  the  lesson,  but  that’s  OK.  ■ 

Comments  and  favorite  SSID  stories  to  buzz@nww.com. 
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DB2on 

POWER: 

3x  faster. 

Check. 

As  low  as 

1/3  the  price. 
Mate. 

Which  database  has  the  right  moves?  DB2®  on  Power  Systems™  performs 
three  times  faster  per  core  than  Oracle  Database  on  SPARC— based  on 
both  TPC-C  and  SAP®  SD  benchmarks!  Yet  the  price  of  DB2  is  as  low  as 
1/3  the  price  of  Oracle  Database!*  Maybe  that’s  why  in  2010  over  1,000 
Oracle  Database  clients  chose  DB2  instead.  Game  over. 

ibm.com/facts 


'PERFORMANCE:  www.tpc.org  as  of  3/28/11  [IBM  Power  780  (3  x  64  C)(24  Ch/192  C/768  Th);  10,366,254  tpmC;  $1.38/tpmC;  avail.  10/13/10  v.  Oracle  SPARC  SuperCluster  w/T3-4  Servers  (27  x  64 
C)(108  Ch/1728  C/13824  Th);  30,249,688  tpmC;  $1.01/tpmC;  avail.  6/1/11].  TPC-C  is  a  trademark  of  Transaction  Performance  Processing  Council.  2-tier  SAP  SD  standard  application  benchmark 
results  as  of  3/28/11  [IBM  Power  795  (32  P/256  C/1024  Th);  126,063  users,  SAP  ERP  6.0  EhP4/AIX  7.1  +  DB2  9.7;  cert.  2010046  v.  Oracle  SPARC  Enterprise  Server  M9000  (64  P/256  C/512 
Th);  39,100  users,  SAP  ERP  6.0/Solaris  10,  Oracle  lOg;  cert.  2008042]  www.sap.com/benchmark.  SAP  and  all  SAP  logos  are  trademarks  or  registered  trademarks  of  SAP  AG  in  Germany  and 
several  other  countries.  "PRICE:  based  on  publicly  avail.  U.S.  info  on  2/10/2011  for  IBM  DB2  Advanced  Enterprise  Edition  +  Oracle  software  w/comparable  capabilities.  No  SAP  SD  benchmark 
results  are  used  for  any  price/performance  metrics.  IBM:  100  Processor  Value  Units.  Oracle:  assumes  1.0  processor  multiplier  Both  incl.  Y1  maint/support.  IBM,  the  IBM  logo,  ibm.com,  DB2,  Power 
Systems,  Smarter  Planet  and  the  planet  icon  are  trademarks  of  International  Business  Machines  Corp,  registered  in  many  jurisdictions  worldwide.  Other  product  and  service  names  might  be 
trademarks  of  IBM  or  other  companies.  A  current  list  of  IBM  trademarks  is  available  on  the  Web  at  www.ibm.com/legal/copytrade.shtml.  ©  International  Business  Machines  Corporation  2011. 


